AUTHENTICATED 
U.S. GOVERNMENT 
INFORMATION ^ 


S. Hrg. 110-721 

MEDICARE VULNERABILITIES: PAYMENTS FOR 
CLAIMS TIED TO DECEASED DOCTORS 


HEARING 

BEFORE THE 

PERMANENT SUBCOMMITTEE ON INVESTIGATIONS 

OF THE 

COMMITTEE ON 
HOMELAND SECURITY AND 
GOVERNMENTAL AFFAIRS 
UNITED STATES SENATE 

OF THE 

ONE HUNDRED TENTH CONGRESS 

SECOND SESSION 

JULY 9, 2008 

Available via http://www.gpoaccess.gov/congress/index.html 
Printed for the use of the 

Committee on Homeland Security and Governmental Affairs 



U.S. GOVERNMENT PRINTING OFFICE 
44-122 PDF WASHINGTON : 2008 


For sale by the Superintendent of Documents, U.S. Government Printing Office 
Internet: bookstore.gpo.gov Phone: toll free (866) 512—1800; DC area (202) 512-1800 
Fax: (202) 512-2104 Mail: Stop IDCC, Washington, DC 20402-0001 


COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS 


JOSEPH I. LIEBERMAN, Connecticut, Chairman 


CARL LEVIN, Michigan 
DANIEL K. AKAKA, Hawaii 
THOMAS R. CARPER, Delaware 
MARK PRYOR, Arkansas 
MARY L. LANDRIEU, Louisiana 
BARACK OBAMA, Illinois 
CLAIRE McCASKILL, Missouri 
JON TESTER, Montana 


SUSAN M. COLLINS, Maine 
TED STEVENS, Alaska 
GEORGE V. VOINOVICH, Ohio 
NORM COLEMAN, Minnesota 
TOM COBURN, Oklahoma 
PETE V. DOMENICI, New Mexico 
JOHN WARNER, Virginia 
JOHN E. SUNUNU, New Hampshire 


Michael L. Alexander, Staff Director 
Brandon L. Milhorn, Minority Staff Director and Chief Counsel 
Trina Driessnack Tyrer, Chief Clerk 


PERMANENT SUBCOMMITTEE ON INVESTIGATIONS 


CARL LEVIN, 

THOMAS R. CARPER, Delaware 
MARK L. PRYOR, Arkansas 
BARACK OBAMA, Illinois 
CLAIRE McCASKILL, Missouri 
JON TESTER, Montana 


Michigan, Chairman 

NORM COLEMAN, Minnesota 
TOM COBURN, Oklahoma 
PETE V. DOMENICI, New Mexico 
JOHN WARNER, Virginia 
JOHN E. SUNUNU, New Hampshire 


Elise J. Bean, Staff Director and Chief Counsel 
Kristina Ko, Legislative Assistant to Senator Levin 
Mark L. Greenblatt, Staff Director and Chief Counsel to the Minority 
Clifford C. Stoddard, Jr., Counsel to the Minority 
Mary D. Robertson, Chief Clerk 


(II) 



CONTENTS 


Opening statements: Page 

Senator Levin 1 

Senator Coleman 3 

Senator Carper 6 

Senator Collins 9 

Senator McCaskill 10 

Senator Coburn 11 

WITNESSES 

Wednesday, July 9, 2008 

Herb B. Kuhn, Deputy Administrator, Centers for Medicare & Medicaid Serv- 
ices, U.S. Department of Health and Human Services 12 

Robert Vito, Regional Inspector General for Evaluation and Inspections, Of- 
fice of Inspector General, U.S. Department of Health and Human Services .. 14 

William E. Gray, Deputy Commissioner of Systems, Social Security Adminis- 
tration 16 

Alphabetical List of Witnesses 

Gray, William E.: 

Testimony 16 

Prepared statement 63 

Kuhn, Herb B.: 

Testimony 12 

Prepared statement 41 

Vito, Robert: 

Testimony 14 

Prepared statement 49 

EXHIBITS 

1. Followup responses received from the Centers for Medicare & Medicaid 

Services (CMS) 69 

2. Permanent Subcommittee on Investigations Staff Report: Medicare 

Vulnerabilities: Payments For Claims Tied to Deceased Doctors 80 

3. Permanent Subcommittee on Investigations Minority Staff Report: Medi- 
care Vulnerabilities: The Use of Diagnosis Codes in DME Claims Ill 


(III) 




MEDICARE VULNERABILITIES: PAYMENTS 
FOR CLAIMS TIED TO DECEASED DOCTORS 


WEDNESDAY, JULY 9, 2008 

U.S. Senate, 

Permanent Subcommittee on Investigations, 
of the Committee on Homeland Security 
and Governmental Affairs, 

Washington, DC. 

The Subcommittee met, pursuant to notice, at 10:02 a.m., in 
Room SD-342, Dirksen Senate Office Building, Hon. Carl Levin, 
Chairman of the Subcommittee, presiding. 

Present: Senators Levin, Carper, McCaskill, Coleman, Collins, 
and Coburn. 

Staff Present: Kristina Ko, Legislative Assistant to Senator 
Levin; Mark L. Greenblatt, Staff Director and Chief Counsel to the 
Minority; Clifford C. Stoddard, Jr., Counsel to the Minority; Tim- 
othy R. Terry, Counsel to the Minority; Mary D. Robertson, Chief 
Clerk; Gina Reinhardt, Congressional Fellow; Nicholas Standiford, 
Intern; Donell Ries, GAO Detailee; Jonathan Ende, Intern; and 
John Kim, Law Clerk; Peggy Gustafson (Senator McCaskill); John 
Collins (Senator Carper); Priscilla Hanley (Senator Collins); and 
Evan Feinberg (Senator Coburn). 

OPENING STATEMENT OF SENATOR LEVIN 

Senator Levin. Good morning, everybody. 

Medicare is a critically important program that provides essen- 
tial health care to folks across the country. But Medicare has a rep- 
utation for weak controls that waste hundreds of millions of tax- 
payer dollars each year. Today’s hearing provides one example of 
those weak controls. From 2000 to 2007, we estimate that nearly 
half a million payments, totaling about $76 million, went to med- 
ical equipment suppliers that had submitted claims using the iden- 
tification numbers of 17,000 deceased doctors, and that represents 
about half of the deceased doctor population. 

At the request of Senator Coleman, the Subcommittee undertook 
this investigation to examine Medicare claim prescriptions for du- 
rable medical equipment presumably authorized by deceased doc- 
tors. This program is operated by the Centers for Medicare & Med- 
icaid Services (CMS). 

We found that doctors who had died 1, 5, even 10 years earlier, 
were listed on Medicare claims prescribing equipment supposedly 
ordered by them years after their death. Here is how the Sub- 
committee estimates the dollar amounts of these claims. The Sub- 
committee received, from the American Medical Association, a list 
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of physicians whose dates of death were between 1992 and 2002. 
We identified more than 33,000 deceased physicians who had what 
are called Unique Physician Identification Numbers (UPINs), and 
we created a random sample of 1,500 of those physicians. We then 
requested data from CMS about claims that had been filed from 
2000 to 2007 using those physician identifiers on a prescription 
dated more than a year after the physician’s death. 

Within our sample of 1,500 doctors, we found that 734 UPINs, 
or about half of the sample, were used by durable medical equip- 
ment suppliers on 21,000 claims totaling over $3.4 million during 
that 7-year period. That is an average of almost 30 false claims 
filed per deceased doctor, or about $4,600 paid out per deceased 
doctor. Then we used those numbers to generate statistically valid 
estimates of the total population of erroneous payments for medical 
equipment using the UPINs of deceased physicians. We estimate 
that, from 2000 to 2007, the UPINs of more than 17,000 deceased 
physicians were used on close to a half a million erroneous claims 
for durable medical equipment that were paid over $76 million. 
The failure to reject these claims raises questions about who at 
Medicare is safeguarding taxpayer dollars, and why basic protec- 
tions are not in place. 

One example is a physician in Florida who died in 1999. Six to 
7 years later, from November 2005 through November 2006, Medi- 
care paid out over $544,000 worth of durable medical equipment 
claims supposedly ordered by this physician. 

How is that possible? It seems apparent that the CMS system 
has failed to adequately monitor and audit the contractors who are 
paid to update the UPIN numbers and process the durable claims, 
the medical equipment claims. When a durable medical equipment 
claim comes in, the CMS contractor who processes the claims — 
called a DME Regional Carrier, (DMERC) — is supposed to verify 
that the claim includes a valid and active UPIN for the prescribing 
physician. If the UPIN does not exist or if it is assigned to a physi- 
cian that is deceased, the claim should not be paid. It is supposed 
to be that simple. 

When the $544,000 in Florida durable medical equipment claims 
were submitted to Medicare using the UPIN of a physician who 
had died up to 7 years earlier, the contractor should have deter- 
mined that the claims were invalid. Instead, the contractor accept- 
ed the claims from these companies using the deceased doctor’s 
UPIN. While those claims happened to be in Florida, contractors 
have been approving claims filed with deceased doctors’ UPINs all 
over the country. We estimate that about 2,500 deceased physicians 
still had active UPINs as of May of this year. 

What makes matters worse is that CMS was alerted to UPIN 
failures back in 2001 and said they took steps to correct it, but 
then never re-evaluated the situation to ensure that the problem 
was fixed. It was in November 2001, when the Inspector General 
of the Department of Health and Human Services, released a re- 
port finding that over $90 million had been paid for medical equip- 
ment and supply claims with invalid or inactive UPINs in 1999 
alone. In 2002, CMS said that they implemented procedures to en- 
sure that these medical equipment claims with inactive or invalid 
UPINs, including those belonging to deceased physicians, would be 
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rejected. CMS issued instructions to its contractors, including the 
National Heritage Insurance Company, the contractor that main- 
tained the UPIN registry — and, by the way, these are all contrac- 
tors that are for-profit. These are not nonprofit contractors. CMS 
instructed them to conduct a one-time cleanup to eliminate de- 
ceased physicians’ UPINs. They were then paid to update their 
UPIN registries every 15 months. Its contractors were also re- 
quired, as of April 1, 2002, to reject all claims using the UPINs of 
deceased physicians. Looking internally, CMS also issued a direc- 
tive to reprogram its own data system to guarantee the rejection 
of these types of claims. 

Apparently, neither CMS nor their contractors did what they 
were supposed to do. The UPIN registry was not kept up to date. 
The contractors’ systems did not reject deceased physician claims. 
Neither did the CMS data system. And no one — CMS or the con- 
tractors — checked to see if the procedures were working. So 7 years 
after the IG report, we are back where we started, with CMS pay- 
ing claims containing UPINs assigned to deceased doctors. 

A few months ago, CMS terminated the use of the UPIN registry 
and replaced it with a new registry. But unless CMS and their con- 
tractors are held accountable for failures, and unless companies 
who wrongfully profited from improper use of deceased physicians’ 
identification numbers are held accountable, we will be back here 
7 years from now asking the same questions. 

The failure to stop payment of deceased physician claims is inex- 
cusable since dates of deaths are so readily available. This type of 
abuse should have been stopped long ago. It is easy to obtain de- 
ceased physicians’ identification numbers and easy to use those 
numbers to obtain payouts through fraudulent claims. As long as 
millions of dollars in claims with deceased provider identification 
numbers are paid, fraudsters will continue to rip off the system. 

To examine these issues in greater detail, we are going to hear 
today from some of the agencies that deal with Medicare, the Cen- 
ters for Medicare & Medicaid Services — CMS — the Inspector Gen- 
eral of the Department of Health and Human Services, and the So- 
cial Security Administration. Each of these agencies has cooperated 
with the Subcommittee’s inquiry. We appreciate that cooperation, 
but we will, of course, press them as hard as we can to end the 
taxpayer rip-off that we have identified. 

Finally, I would like to again thank the Subcommittee’s Ranking 
Republican, Norm Coleman, who initiated this investigation, and 
his staff, who have worked hard to examine these issues. 

Now I will call on Senator Coleman. 

OPENING STATEMENT OF SENATOR COLEMAN 

Senator Coleman. Thank you. Thank you, Senator Levin, and let 
me return the thanks by saying that you and your staff have been 
extremely supportive. Like all our investigations, this has been a 
tremendous bipartisan effort, and I certainly appreciate that very 
much. 

This morning, we turn our attention to a familiar topic: Medicare 
fraud and abuse. And I do want to be very clear from the beginning 
that Medicare is an important program that provides health insur- 
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ance for the elderly and the disabled. It is a genuine blessing for 
many of America’s most vulnerable citizens. 

But the program has been plagued by persistent and pervasive 
fraud and abuse. For almost 20 years, the Government Account- 
ability Office has consistently designated the Medicare program as 
“high risk” because of its vulnerability to mismanagement and im- 
proper payments. According to its own reports, Medicare made im- 
proper payments in 2004 and 2005 amounting to roughly $34 bil- 
lion. That is the size of the entire Minnesota State budget general 
fund — wasted on improper payments. 

One Harvard professor estimated that fraud and abuse could 
consume about 15 to 20 percent of the Medicare budget. That 
would be more than $70 billion in 2008 alone. Let’s remember that 
these billions and billions are tax dollars paid by hard-working 
Americans. 

In keeping with our long tradition of government oversight, the 
Subcommittee spent the past year examining the Medicare pro- 
gram. Our bipartisan inquiry ultimately zeroed in on abuses in 
payments for durable medical equipment (DME). 

In short, the Subcommittee’s investigation uncovered some ap- 
palling facts. The Subcommittee found that, between 2000 and 
2007, Medicare paid for hundreds of thousands of DME claims in 
which the prescribing doctor had died years earlier. It has been es- 
timated, as the Chairman has noted, that these payments for those 
claims could total over $70 million, possibly $100 million. The evi- 
dence also establishes certain links to fraudulent activity, which we 
will examine shortly. Clearly, we have a problem. 

Although the jargon can get confusing, here is the big picture: 
Medicare regulations require that DME claims contain certain in- 
formation in order to qualify for payment, including valid identi- 
fication numbers for the patient, the DME supplier, and the pre- 
scribing doctor. As the Chairman has noted, the doctor’s ID number 
is a UPIN. 

The bottom line is that Medicare paid tens of millions of dollars 
on claims that contained the UPINs of doctors who died long before 
the claims were filed. For hundreds of thousands of claims, the doc- 
tors had passed away 5, 10, or even 15 years beforehand. 

To get a sense of the problem, I just want to review a few alarm- 
ing cases: 

The Chairman has discussed the case of the Florida doctor who 
passed away in 1999 with claims to the tune of over $500,000 being 
processed. At least three different companies used this doctor’s ID 
number, filing claims using his ID number 6, 7, or 8 years after 
the doctor died. Two of the culprits have been convicted of health 
care fraud, and the other companies were cited by State health 
agencies for violations. Altogether, the Subcommittee identified at 
least $350,000 paid by Medicare to these fraudulent actors for 
claims containing the ID number of this one doctor alone. 

Another doctor passed away in 2001, and his UPIN was used in 
more than 3,800 claims submitted between 2002 and 2007. The 
total payments for these claims amounted to over $354,000. 

The UPIN of another physician who died before 1999 was listed 
in more than 2,000 claims submitted up to 8 years after he died. 
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These claims resulted in Medicare payments of more than 
$478,000. 

Now, what is alarming is that the problems are not new; that 
CMS had been notified of these issues several years ago; that the 
Inspector General of the Department of Health and Human Serv- 
ices reported that Medicare had paid tens of millions for claims 
with invalid and inactive UPINs. The IG urged CMS to make 
changes to ensure that the system was fixed. 

CMS then did that. They then stated that claims with UPINs of 
deceased doctors would not be paid starting April 1, 2002. CMS at- 
tempted to fix the problems in 2002. They instituted several proce- 
dures designed to ensure that the claims with UPINs of these de- 
ceased physicians would not be used. 

Unfortunately, the Subcommittee’s investigation establishes that 
those changes did not work. For instance, even though CMS’ new 
procedures were supposed to reject claims with UPINs of dead doc- 
tors starting on April 1, 2002, the evidence obtained by the Sub- 
committee reveals that an estimated 63 percent of the improper 
payments occurred after that date. 

Similarly, CMS required that the UPIN database must be up- 
dated every 15 months and the UPINs of dead doctors must be de- 
activated. Yet the evidence indicates that the UPINs of thousands 
of physicians remained active, even though they passed away long 
ago. For instance, the Subcommittee estimates that the UPINs of 
thousands of doctors who passed away in the 1990s were still ac- 
tive as of this past May. 

It is clear that the claims review process has not worked prop- 
erly. Medicare has not made sure that dead doctors are removed 
from the system and that claims linked to those doctors are re- 
jected. This is simply unacceptable. Making sure that the pre- 
scribing doctor is alive before paying a claim should be a no- 
brainer. These errors leave Medicare — and, therefore, American 
taxpayers — vulnerable to fraud. The problem must be fixed and it 
must be fixed now. 

How do we clean up the system? The good news is that we have 
a unique opportunity right now to address the problem. Medicare 
has recently replaced the old UPINs with a new numbering system 
called the National Provider Identifier (NPI). So there is a golden 
opportunity to make sure that the problems are fixed at an early 
stage and make sure that the improper payments that plagued the 
UPINs will not recur with the NPIs. 

I just have to state this. We live in a high-tech world. FedEx and 
UPS can track every movement of a flow of goods. Surely we 
should have the capacity to figure out if doctors are dead and not 
making payments. Information is reported. Social Security has it. 
The AMA has it. And to me it is somewhat incomprehensible that 
we do not have in government the computer capability — I should 
not say in government as the Chairman indicated, we have outside 
providers here that they do not have the computer capability to 
match a dead doctor’s ID number with a claim that is being proc- 
essed after they died. 

We cannot afford $100 million loopholes, especially not now. 
There are too many challenges that this country is facing — energy, 
education, homeland security, and housing. And what is required 
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now is an unprecedented level of fiscal discipline and political lead- 
ership to overcome these challenges. 

I will close by saying that, almost every day, my staff and I learn 
of a deserving Minnesota senior that is having a problem with 
Medicare coverage. If we want to look them in the eye and say we 
are trying to fix their problem, Job Number One must be attacking 
Medicare fraud, waste, and abuse so that precious tax dollars go 
to the noble use for which they were intended. 

We have a special responsibility to preserve the integrity of a 
vital service to the Nation’s elderly and disabled, and I am con- 
fident that CMS will be a productive and willing partner in that 
effort. I look forward to discussing with each of today’s witnesses 
how we can work together to ensure that Medicare accomplishes its 
noble goals while protecting American tax dollars from fraud, 
waste, and abuse. 

Thank you, Mr. Chairman. 

Senator Levin. Thank you, Senator Coleman. 

Let me now welcome our panel of witnesses for today’s hearing: 
Herb Kuhn, the Deputy Administrator for the Centers for Medicare 
and Medicaid Services of the Department of Health and Human 
Services here in Washington; Robert Vito, the Regional Inspector 
General for the Office of Evaluations and Inspections of the De- 
partment of Health and Human Services in Philadelphia; and Wil- 
liam Gray, the Deputy Commissioner for the Office of Systems of 
the Social Security Administration in Baltimore. 

Gentlemen, I want to thank each of you for being here today. I 
want to thank you for the cooperation of your agencies. We look 
forward to your testimony. 

Before we call on you, I understand there are other Members 
who may want to give brief opening statements, and we would be 
happy to accommodate that. So let me first call on Senator Carper. 

OPENING STATEMENT OF SENATOR CARPER 

Senator Carper. Thank you, Mr. Chairman. I have a statement 
I would like to enter for the record. Let me just briefly say, how- 
ever, when you look in the dictionary and you look up a word and 
sometimes they have a picture beside the word? I don’t know if 
there is any place in the dictionary where we look up “low-hanging 
fruit.” But I think if there were, we would find this issue of making 
Medicare payments to doctors who have been dead in some cases 
for many years. If we cannot go out and make sure that we are not 
making those kinds of improper payments, heaven help us. 

Yesterday, a reporter grabbed me. I was on my way into the LBJ 
Room for our weekly caucus luncheon, and they said, “I understand 
that the Medicare trust fund is in enormous difficulty, and it is 
going to go broke, and you guys are going to raise taxes.” And I 
said, well, before we raise taxes, I think there are a couple things 
we need to do. One of those is to make sure that we are collecting 
the taxes that are owed, and there are a lot of taxes that are owed 
that are not being collected, including some of these for our payroll 
taxes. 

The second thing we need to do is to stop making payments to 
deceased physicians who are no longer providing Medicare services. 
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The third thing we may want to do is to look at the monies that 
we spend on equipment, whether it is wheelchairs or oxygen and 
that sort of thing, to make sure that we are getting our value, our 
dollar’s worth from the money that we are spending. 

And another thing we might want to do, this is something that 
Dr. Coburn and I have been working on. We have a strong interest 
in addressing not just overpayments or improper payments in 
Medicare, but across the Federal Government. And one of the 
things that we have learned is there is about $55 to $60 billion in 
improper payments that we are aware of, and that does not cover 
all the agencies. But we have got a ton of it that is in Medicare. 
Actually, in the last 2 or 3 years, there has been a post-audit recov- 
ery operation going on with Medicare. They focused on three 
States: California, Florida, and New York. Last year, they recov- 
ered about $1 billion. That is real money. And I think we are just 
scratching the surface there. 

So before we raise taxes, those are a couple things we need to 
do. And for God’s sake, for something that would seem to be as 
easy to fix as this, if we cannot do this, heaven help us when it 
comes to going after the tough stuff. 

I am delighted we are having this hearing. This is oversight at 
its best, putting a spotlight on something that we ought to know 
better than to let happen. I think by virtue of having this hearing, 
we are going to make sure that this does not continue to be a prob- 
lem, and hopefully we will remind some other folks who have low- 
hanging fruit that can be snatched up in their own operations in 
the Federal Government, whether it is CMS or elsewhere, that 
they need to be more diligent in the work they do. And to the ex- 
tent that there is stuff that we can do here in the Congress, in this 
Subcommittee or otherwise, that can help give you the tools that 
you need to ensure that this kind of stuff does not happen, we need 
to hear that as well. 

We thank you for being here and look forward to your testimony. 

[The prepared opening statement of Senator Carper follows:] 

PREPARED OPENING STATEMENT OF SENATOR CARPER 

Thank you Mr. Chairman. 

I’m pleased that you and Senator Coleman have taken on this issue and are hold- 
ing this hearing today. 

Senator Coburn and I held a hearing at in our Financial Management sub- 
committee just before the 4th of July recess about the dire long-term financial crisis 
our nation faces. We heard testimony from the administration, from GAO, and from 
experts like former Comptroller General David Walker about what we need to do 
and what the next administration will need to do to turn things around. 

The conclusions that are witnesses came to shouldn’t be a surprise to any of us. 
We need to reform entitlement programs like Medicare and Social Security because, 
as the Baby Boom generation retires, these programs will eat up a bigger and bigger 
portion of our budget. We need to redefine our spending priorities and start focusing 
again on balancing our budget. We need to redefine our priorities on the revenue 
side as well and, along with that, do as much as we can to collect those taxes that 
are owed to the Treasury each year, but never paid. Finally, we need to do all we 
can to stop agencies from making avoidable improper payments. 

Senator Coburn and I have been working on this improper payments issue for 
years now. According to the latest figures released by OMB — and these are based 
on numbers from fiscal year 2007 — agencies are making an estimated $55 billion in 
improper payments each year. Nearly $11 billion of that total can be attributed to 
the Medicare fee-for-service program. Nearly $13 billion can be attributed to Med- 
icaid. So nearly half of the improper payments — and keep in mind that these are 
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avoidable errors — are attributable to the programs for which Mr. Kuhn and his 
team at CMS are responsible. 

We are wasting a tremendous amount of money year-in and year-out. But the $55 
billion estimate that OMB has reported does not yet even include improper pay- 
ments made in a number of large programs, including the Medicare Advantage and 
Medicare Prescription Drug Program. 

We have our work cut out for us. I was troubled, then, to read over the materials 
for this hearing and learn that, as challenging as the improper payments problem 
is at CMS, we are not doing all we can to go after the low-hanging fruit. As I under- 
stand it, CMS knew about the payments to deceased doctors that we’ll be discussing 
today but just didn’t follow through. That is unacceptable. So I look forward to hear- 
ing from our witnesses to learn more about the path forward on this issue in par- 
ticular, but also on the larger improper payments issue that has been plaguing the 
Medicare and Medicaid programs for a number of years now. 

There may come a time in the not-so-distant future when Congress will be called 
upon to make some painful decisions about the future of these programs, especially 
Medicare. The least that we can do between now and then is eliminate the silly mis- 
takes that have already contributed to billions in waste. 

Thank you again, Mr. Chairman. 

Senator Carper. Thank you, Mr. Chairman. 

I’m pleased that you and Senator Coleman have taken on this 
issue and are holding this hearing today. 

Senator Coburn and I held a hearing at in our Financial Man- 
agement subcommittee just before the 4th of July recess about the 
dire long-term financial crisis our nation faces. We heard testimony 
from the administration, from GAO, and from experts like former 
Comptroller General David Walker about what we need to do and 
what the next administration will need to do to turn things around. 

The conclusions that are witnesses came to shouldn’t be a sur- 
prise to any of us. We need to reform entitlement programs like 
Medicare and Social Security because, as the Baby Boom genera- 
tion retires, these programs will eat up a bigger and bigger portion 
of our budget. We need to redefine our spending priorities and start 
focusing again on balancing our budget. We need to redefine our 
priorities on the revenue side as well and, along with that, do as 
much as we can to collect those taxes that are owed to the Treas- 
ury each year, but never paid. Finally, we need to do all we can 
to stop agencies from making avoidable improper payments. 

Senator Coburn and I have been working on this improper pay- 
ments issue for years now. According to the latest figures released 
by OMB — and these are based on numbers from fiscal year 2007 — 
agencies are making an estimated $55 billion in improper pay- 
ments each year. Nearly $11 billion of that total can be attributed 
to the Medicare fee-for-service program. Nearly $13 billion can be 
attributed to Medicaid. So nearly half of the improper payments — 
and keep in mind that these are avoidable errors — are attributable 
to the programs for which Mr. Kuhn and his team at CMS are re- 
sponsible. 

We are wasting a tremendous amount of money year-in and year- 
out. But the $55 billion estimate that OMB has reported does not 
yet even include improper payments made in a number of large 
programs, including the Medicare Advantage and Medicare Pre- 
scription Drug Program. 

We have our work cut out for us. I was troubled, then, to read 
over the materials for this hearing and learn that, as challenging 
as the improper payments problem is at CMS, we are not doing all 
we can to go after the low-hanging fruit. As I understand it, CMS 
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knew about the payments to deceased doctors that we’ll be dis- 
cussing today but just didn’t follow through. That is unacceptable. 
So I look forward to hearing from our witnesses to learn more 
about the path forward on this issue in particular, but also on the 
larger improper payments issue that has been plaguing the Medi- 
care and Medicaid programs for a number of years now. 

There may come a time in the not-so-distant future when Con- 
gress will be called upon to make some painful decisions about the 
future of these programs, especially Medicare. The least that we 
can do between now and then is eliminate the silly mistakes that 
have already contributed to billions in waste. 

Thank you again, Mr. Chairman. 

Senator Levin. Thank you, Senator Carper. Senator Collins. 

OPENING STATEMENT OF SENATOR COLLINS 

Senator Collins. Thank you, Mr. Chairman. 

Let me thank both the Chairman and the Ranking Member for 
holding this hearing and conducting this investigation. I am going 
to put my full statement into the record and just make a few com- 
ments with the Chairman’s permission. 

First of all, I come to this hearing with a disturbing sense of 
deja-vu because the very first hearing that I chaired of this Sub- 
committee back in 1997 focused on fraud and abuse in the Medi- 
care program. And during our investigation 11 years ago, we 
learned that the Medicare program loses more than $20 billion a 
year to waste, fraud, and abuse. Moreover, our investigation re- 
vealed far too many instances where Medicare and its contractors 
regularly wrote checks first and asked questions later. 

For example, we discovered back in 1997 that Medicare had paid 
more than $6 million to durable medical equipment companies that 
had provided no goods or services whatsoever, and one of those 
companies listed an absurd fictitious address that, had it existed, 
would have been in the middle of the runway of the Miami Inter- 
national Airport. 

I mention that particular case because just as sending checks 
based on claims from deceased doctors seems absurd and impos- 
sible to have occurred, sending checks to fictitious addresses also 
was occurring. 

It is disturbing that the Subcommittee’s current investigation re- 
veals that so little has changed. Unscrupulous actors continue to 
take advantage of the system, wasting billions of taxpayer dollars 
and undermining the credibility of what, as Senator Coleman has 
pointed out, is an absolutely vital program to our seniors and dis- 
abled citizens. 

So I am very concerned that for a decade the Medicare program 
has been on the GAO’s high-risk list. For more than a decade, con- 
gressional investigations have time and time again shined a spot- 
light on egregious fraud. And yet so little seems to have changed, 
and that to me is very disturbing and completely unacceptable. 

So it is my hope that PSI’s investigation and report, the excellent 
bipartisan work that has been done by this Subcommittee’s leaders, 
will finally lay the groundwork for legislative and administrative 
reforms to address this problem once and for all. There are many 
issues the Federal Government faces that are complex and difficult 
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to resolve, but paying fictitious claims submitted by people using 
the identification numbers of deceased doctors does not seem to be 
one of them. Our Nation’s taxpayers and seniors and disabled 
Americans who depend on the Medicare program deserve no less. 

Thank you, Mr. Chairman, and thank you, Senator Coleman, for 
your excellent work. 

[The prepared opening statement of Senator Collins follows:] 

PREPARED STATEMENT OF SENATOR SUSAN M. COLLINS 

Mr. Chairman, I commend the Chair and Ranking Member for calling this morn- 
ing’s hearing which is based on the Subcommittee’s investigation into waste, fraud 
and abuse in the Medicare program, with a particular focus on durable medical 
equipment claims. 

When I first came to the Senate in 1997, I had the honor and privilege of serving 
as Chairman of this Subcommittee. The very first hearing that I chaired was fo- 
cused on the Subcommittee’s ongoing efforts to investigate and expose fraud and 
abuse in the Medicare program, with the twin goals of protecting the taxpayer from 
unscrupulous individuals who were stealing literally billions of dollars from Medi- 
care and of protecting elderly and disabled Americans who rely upon this critically 
important program for their health care needs. 

During the course of our investigation, we learned that the Medicare program 
loses more than $20 billion a year to waste, fraud and abuse. Moreover, our inves- 
tigation revealed far too many instances where the then-HCFA and its contractors 
regularly wrote checks first and asked questions later. For example, we discovered 
that Medicare had paid over $6 million to durable medical equipment companies 
that provided no goods or services whatsoever. One of these companies even listed 
an absurd fictitious address, that, had it existed, would have been in the middle of 
the runway of the Miami International Airport. 

Sadly, as the Subcommittee’s current investigation reveals, little has changed. 
Unscrupulous actors continue to take advantage of the system, wasting billions of 
taxpayer dollars and undermining the credibility of the Medicare program in the 
process. 

The Subcommittee’s current investigation has found that Medicare has paid as 
much as $92 million over the past seven years for durable medical equipment claims 
containing the identification numbers of deceased prescribing physicians, many of 
whom had died ten years or more before the service date on the claims. 

Moreover, these problems are not new. In 2001, the HHS Inspector General re- 
ported that Medicare paid $91 million in 1999 for medical equipment and supply 
claims with invalid or inactive numbers. In response to this report, CMS did take 
steps to reject claims containing the provider identification numbers of deceased 
physicians. These efforts, however, have evidently not been successful, since the 
claims are still being paid. 

Mr. Chairman, it is my hope that PSI’s investigation and report will help lay the 
groundwork for legislative and administrative reforms to address this problem once 
and for all. Our nation’s taxpayers and the seniors and disabled Americans who de- 
pend on the Medicare program deserve no less. 

Senator Levin. Thank you, Senator Collins. Senator McCaskill. 

OPENING STATEMENT OF SENATOR MCCASKILL 

Senator McCaskill. Thank you, Mr. Chairman. In preparing for 
this hearing today, I think as Senator Collins just said, the part 
that was most depressing is that I assumed that this was a prob- 
lem that had just come to light, because this is the kind of problem 
when it comes to light, I think most average people think this is 
not a hard fix. 

CMS has full access to the Social Security Administration data- 
base relating to deaths, and it is deemed to be 99.5 percent accu- 
rate. We are talking about a data match. We are talking about 
something that people do all the time in terms of data matches. 
And the idea that this was exposed as long ago as it was exposed 
and as of May of this year we still have 2,900 deceased physicians 
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still active in this database — that is enough to make you want to 
tear your hair out. 

The sense of urgency appears to be missing, and I know that all 
of you have important jobs, and I know that this is a massive pro- 
gram. But somebody has to explain to me today why this is so 
hard. Why a problem that has been identified as creating an exces- 
sive amount of fraud and waste in a program that is going broke, 
that is so dramatically needed by the American people, is incom- 
petence, frankly. And I do not understand it. 

Now, the other thing that I am concerned about that I hope we 
cover today is that in June, CMS temporarily allowed the suppliers 
to use their own NPIs rather than the NPIs of order physicians. 
In auditing, there is a very important concept called “segregation 
of duties.” Segregation of duties is, in fact, as the Inspector Gen- 
eral — I see him nodding his head. It is the best tool we have to 
make sure that there is not fraud, waste, and abuse. And when you 
allow on a temporary basis them to use their own numbers instead 
of the doctor’s number, you are taking away a segregation of du- 
ties. We are going the opposite direction that we should be going 
in terms of ensuring that we root out this important amount of 
fraud and waste. 

So I really appreciate all those who have come to this Sub- 
committee before me, that have worked on this. Thank you, Mr. 
Chairman and the Ranking Member. And, obviously, I thank the 
others that exposed this problem over a decade ago. But there is 
somebody over there that is not mad enough, and they need to be 
getting mad. Thank you, Mr. Chairman. 

Senator Levin. Thank you, Senator McCaskill. Senator Coburn. 

OPENING STATEMENT OF SENATOR COBURN 

Senator Coburn. Mr. Chairman and Ranking Member Coleman, 
thank you for having the hearing. I have to say that I am some- 
what perplexed. We are looking at $100 million worth of fraud. If 
you combine the CRS studies, the IG studies, and the GAO, we 
have $80 billion a year in waste, fraud, and abuse in the Medicare 
and Medicaid programs. I am not belittling the $100 million. 

The Congress this week is going to pass a bill probably that 
eliminates $1 billion worth of savings per year in terms of DME. 
That is $200 million of premiums that are going to be paid by sen- 
iors that they should not be paying because we felt a little heat 
from competitive bidding. We already pay 30 to 40 percent too 
much for the DME equipment that Medicare buys. 

So I am discouraged because I do not think — we are going to 
have a hearing here today, and the Chairman and Ranking Mem- 
ber are rightly so bringing this forward, and we are going to do a 
lot of talk, and we are going to get after CMS. But when it comes 
to acting responsibly, the Congress is not going to do anything ex- 
cept delay the competitive bidding on DME, which will get rid of 
a lot of the fraudulent DME companies, which is part of the prob- 
lem. 

We passed a farm bill that has $8 billion worth of fraud to dead 
farmers. We could not even get rid of that in the farm bill. We 
passed a farm bill that did not fix that even though we amended 
it in the Senate. When the compromise bill came back, we did not 
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fix it. So there is $8 billion worth of farm fraud that is going out 
to dead farmers and $100 million being paid on DME only — that 
is DME only that we are talking about. We are not talking about 
the fraudulent claims of dead doctors for other things. And yet we 
will not do the hard work as a Senate or as a Congress to come 
alongside behind you. 

So my hope is, Mr. Chairman and Senator Coleman, that you 
start the rolling ball for us to start acting responsibly in the Con- 
gress, first by having this hearing, which I am thankful for, but, 
more importantly, doing the bigger things that need to be done to 
get rid of some of this $80 billion worth of fraud. Eighty billion 
means $200 billion of American taxpayer Medicare money that is 
being paid out, their share in Part B, $200 billion false claims to 
Medicare patients that they are paying for that we have not fixed. 

Thank you. 

Senator Levin. Thank you, Senator Coburn. 

Now, pursuant to Rule VI, all witnesses who testify before the 
Subcommittee are required to be sworn, and at this time I would 
ask each of you to please stand and raise your right hand. Do you 
swear that the testimony you are about to give before this Sub- 
committee will be the truth, the whole truth, and nothing but the 
truth, so help you, God? 

Mr. Kuhn. I do. 

Mr. Vito. I do. 

Mr. Gray. I do. 

Senator Levin. Thank you. We will be using a timing system 
today, and about a minute before the red light comes on, you will 
see the lights change from green to yellow, giving you an oppor- 
tunity to conclude your remarks. Your written testimony will be 
printed in the record in its entirety. We would ask that you limit 
your oral testimony to no more than 5 minutes. 

Mr. Kuhn, we will have you go forward, followed by Mr. Vito, 
and finish up with Mr. Gray. And then after we have heard all of 
the testimony, we will turn to questions. 

Mr. Kuhn, again, thank you for being here. 

TESTIMONY OF HERB B. KUHN , 1 DEPUTY ADMINISTRATOR, 

CENTERS FOR MEDICARE & MEDICAID SERVICES, U.S. DE- 
PARTMENT OF HEALTH AND HUMAN SERVICES 

Mr. Kuhn. Chairman Levin, Mr. Coleman, Members of the Sub- 
committee, thank you for the opportunity to testify today regarding 
the Subcommittee’s findings on Medicare payments for claims con- 
taining invalid and inactive provider identification numbers of de- 
ceased physicians. CMS appreciates the time and resources that 
the Subcommittee has invested in this study and is grateful for the 
Subcommittee’s shared interest and goal in reducing waste, fraud, 
and abuse in the Medicare program. We are currently reviewing 
the findings of your report. We consider these findings very valu- 
able for identifying areas of vulnerability in the program and accel- 
erated our efforts to fix them. 

CMS has taken several steps to implement policy changes and 
new procedures to ensure that invalid or inactive provider identi- 


x The prepared statement of Mr. Kuhn appears in the Appendix on page 41. 
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fication numbers, or PINs, are not used by unscrupulous suppliers 
of Durable Medical Equipment, Prosthetics, Orthotics, and Supplies 
(DMEPOS). Internally, and with our claims-processing contractors, 
we are making changes to substantially curb and, ideally, eliminate 
this practice altogether. 

Specifically, our conversion to the new National Provider Identi- 
fier (NPI), along with further documentation and data exchange 
improvements, have significantly strengthened CMS’ ability to 
combat fraud and abuse that rely on invalid provider identifiers. 
All providers and suppliers intending to bill Medicare are required 
to apply for and secure a new NPI, and to use the NPI exclusively 
on all forms when billing Medicare. Before a NPI is used, CMS 
verifies the Social Security number with the Social Security Admin- 
istration (SSA), thereby verifying the information as accurate at 
the time of issuance. Given this change, CMS believes the vulner- 
ability for further fraud and abuse relying on provider identifiers 
and deceased physicians is substantially smaller today than before 
full NPI implementation. 

However, as you noted in your report, we will need to guard the 
new NPI system, and in order to do that, CMS finalized a new in- 
formation exchange agreement with the Social Security Adminis- 
tration, which will provide CMS with monthly updates of SSA’s 
Death Master File and unrestricted State death data beginning in 
August. CMS will match this information with data contained in 
the National Plan and Provider Enumeration System — the central 
system that maintains information about the NPI — and, of course, 
also our provider enrollment database as well. After confirming an 
individual practitioner is deceased, CMS will deactivate both the 
NPI and the practitioner’s enrollment in the Medicare program. 

But we do not stop there. While our claims-processing system al- 
lows any NPI to be used for ordering and referring services to 
Medicare beneficiaries, we anticipate implementing changes in 
2009 that will limit ordering and referring to only those individual 
practitioners enrolled in the Medicare program. 

In addition to assuring the accuracy of the NPI, we also need to 
work on the other side of the ledger to make sure that we have 
qualified DMEPOS suppliers out there, and in this regard, we are 
taking the following steps to make sure that we work both sides 
of the ledger so that we come to the middle to have a good, secure 
program. 

First, on July 1 — and this is something Dr. Coburn referenced — 
we implemented DME competitive bidding in 10 metropolitan areas 
in the country and plan to expand to 70 more next year. This pro- 
gram, which ushers in new accreditation, financial and quality 
standards for DME suppliers, will substantially increase the qual- 
ity of this program and those who are enrolled as suppliers. Fur- 
thermore, it will bring about market pricing to DME supplies. One 
of the vulnerabilities of the program is when you mis-price some- 
thing, you bring the fraudsters into the program. This will help 
eliminate that. 

Second, we are in the process of completing the final regulation 
that for the first time will require surety bonds for DMEPOS sup- 
pliers. 
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Third, we recently published a proposed rule requiring DMEPOS 
suppliers to maintain ordering and referring documentation re- 
ceived from a physician or other non-physician practitioner for 7 
years. This change, if adopted, will strengthen our ability to iden- 
tify fraudulent billing during documentation reviews. 

And then, finally, through our enrollment demonstration projects 
initiated last summer in South Florida and Los Angeles metropoli- 
tan areas, we were able to revoke the billing privileges of nearly 
1,000 DMEPOS suppliers. 

Protecting Medicare’s integrity, ensuring its efficient operation, 
and assuring safe and quality health care for all beneficiaries is 
our goal in all that we do. In this regard, we appreciate the Sub- 
committee’s work on this issue and your ongoing efforts to support 
the Medicare program’s integrity. 

I look forward to answering any questions that you may have. 

Senator Levin. Thank you, Mr. Kuhn. Mr. Vito. 

TESTIMONY OF ROBERT VITO , 1 REGIONAL INSPECTOR GEN- 
ERAL FOR EVALUATION AND INSPECTIONS, OFFICE OF IN- 
SPECTOR GENERAL, U.S. DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Mr. Vito. Good morning, Mr. Chairman and Members of the 
Subcommittee. I am Robert Vito, Regional Inspector General for 
Evaluation and Inspections at the U.S. Department of Health and 
Human Services’ Office of Inspector General. 

Because the Medicare DME benefit has proven to be particularly 
vulnerable to fraud, waste, and abuse, OIG has devoted substantial 
resources to conducting work in this area. We have performed stud- 
ies on a wide array of DME-related issues; made recommendations 
to help CMS correct vulnerabilities; and performed targeted follow- 
up work to ensure that corrective action has been taken. One such 
issue — the use of ordering UPINs on DME claims — is the subject 
of my testimony today. 

DME and related supplies are only covered by Medicare when or- 
dered by a physician or a health care practitioner. To help ensure 
this condition is met, CMS requires DME suppliers to list the 
UPIN and, as of May 2008, the NPI of physicians who order the 
equipment on the claim form. However, as part of our DME work, 
we learned that Medicare’s claims-processing system only verified 
that the UPIN met a certain format; edits were not being per- 
formed to ensure that the UPIN had been assigned or was active. 

In the November 2001 report, we found that Medicare and its 
beneficiaries paid $32 million for DME claims with invalid UPINs 
in 1999. In addition, $59 million was paid for DME claims listing 
UPINs that were inactive on the date of service. Almost $8 million 
of this involved UPINs for deceased physicians. We recommended 
that CMS revise claims-processing edits to ensure UPINs listed on 
DME claims were valid and active. In response, on two occasions 
CMS issued instructions to its carriers to deny DME claims listing 
deceased physician UPINs. However, other than provider edu- 
cation, we know of no further action taken by CMS to address the 
issue of invalid and inactive UPINs. We annually highlighted this 


lr The prepared statement of Mr. Vito appears in the Appendix on page 49. 
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vulnerability in various publications, including our semiannual re- 
ports to Congress and our “Compendium of Unimplemented Office 
of Inspector General Recommendations.” 

To ensure effective edits for invalid and inactive UPINs, CMS 
needed to maintain accurate information in the UPIN Registry. 
However, in each of the three OIG reports issued between 1999 
and 2003, we found the UPIN Registry contained inaccurate data. 
For example, in the 2003 report, the OIG found that 52 percent of 
the providers listed in the active UPIN database had inaccurate in- 
formation in at least one of their practice settings. Seventeen per- 
cent of the providers no longer billed Medicare from any practice 
setting listed in the active UPIN file, and of that number, 14 per- 
cent were deceased, and 26 percent were retired. 

Because CMS was planning to discontinue the use of UPINs once 
the NPI system was fully implemented, we did not perform addi- 
tional studies on the UPIN for several years. In the interim, we fo- 
cused on other DME issues, including payments for and coverage 
of power wheelchairs, pricing and utilization of inhalation drugs 
covered under the DME benefit, and excessive payments for home 
oxygen equipment. 

We also significantly expanded our efforts into the area of pro- 
vider enrollment. For example, in 2006 and 2007, the OIG con- 
ducted in-person site visits of more than 2,500 DME suppliers in 
South Florida and Los Angeles to assess compliance with Medicare 
supplier standards. 

Now that the NPI is fully implemented, OIG is revisiting the use 
of physician identifiers on DME claims. Based on our preliminary 
analysis and discussion with CMS staff, we have concerns that 
valid and inactive physician numbers may be a continuing problem 
with the NPI. While it appears that edits will be established to 
verify the NPI is in the correct format, it is unclear whether there 
will be controls that identify NPIs that have not been assigned or 
correspond to inactive physicians. 

In addition, according to CMS, DME suppliers are temporarily 
allowed to use their own NPI in place of the NPI of the ordering 
physician. CMS has not indicated when this policy will be discon- 
tinued. However, as long as DME suppliers are allowed to enter 
their own NPI rather than the physician’s, a major control for pre- 
venting fraud, waste, and abuse will not be operational. 

In summary, the OIG will continue to devote considerable re- 
sources to fighting fraud, waste, and abuse in the Medicare pro- 
gram while maintaining a particular focus on vulnerabilities re- 
lated to the DME benefit. As CMS moved away from the UPINs 
and began requiring the use of the NPIs in their place, there was 
an opportunity to address vulnerabilities highlighted in our earlier 
findings and recommendations. However, we remain concerned 
that old vulnerabilities as well as new challenges may affect the in- 
tegrity of the NPI system. To address these concerns, OIG expects 
to conduct studies related to the NPI during the 2009 fiscal year. 

This concludes my statement. Thank you for the opportunity to 
testify today. I would be pleased to answer your questions. 

Senator Levin. Thank you, Mr. Vito. Mr. Gray. 
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TESTIMONY OF WILLIAM E. GRAY , 1 DEPUTY COMMISSIONER 
OF SYSTEMS, SOCIAL SECURITY ADMINISTRATION 

Mr. Gray. Chairman Levin, Members of the Subcommittee, 
thank you for inviting me to appear before you today. You have 
asked us to address two questions: How can we provide death 
record information regarding medical providers on a timely and 
regular basis to the CMS? And what, if anything, do we need to 
facilitate the sharing of death record information with CMS? Before 
I explain how and when we provide death information to CMS, I 
would like to briefly describe who we are and what we do. 

Social Security touches the lives of virtually every American. 
Through the Old-Age, Survivors, and Disability Insurance program, 
we provide benefits at critical junctures in people’s lives: When 
they retire, when they become disabled, and when the family’s 
wage earner dies. We also administer the Supplemental Security 
Income program, which provides a cash assistance safety net for 
aged, blind, and disabled individuals with little or no income or as- 
sets. Each year, we send benefits totaling about $650 billion to al- 
most 60 million individuals. 

In addition, we have other responsibilities that are vitally impor- 
tant to the Nation, but are not directly connected to our core mis- 
sion, including many workloads for other programs, such as Medi- 
care, Medicaid, E-Verify, and Food Stamps. 

We collect and maintain death records which we use to deter- 
mine continuing eligibility for benefits and for other program pur- 
poses. We receive approximately 2.5 million death reports each 
year. They come from a variety of sources, but 90 percent come 
from family members and from funeral homes. My written testi- 
mony describes in some detail how we gather death information 
and the circumstances under which it is made available to other 
Federal agencies and to the public. For purposes of our discussion 
today, I would like to summarize a few points. 

Currently, there are about 85.6 million records on our Death 
Master File, which is commonly known as the DMF. About 4 per- 
cent of these are from State reports. The publicly available Death 
Master File includes all verified death information, but it does not 
include any State death data. However, since 2001, we have given 
CMS access to all of our death records, both public and State. 

We provide the death information to CMS in three ways: 

In 2001, we began providing the public Death Master File to 
CMS via direct electronic connection, and we update it weekly in 
the same way. 

SSA also provides CMS with access to death information via the 
State Verification Exchange System (SVES). SVES is an overnight 
batch query process that matches against our records. In addition 
to the public data, this also gives CMS access to the State data. 
SSA responds each year to approximately 2 million CMS queries to 
SVES. 

SSA also provides CMS with access to the State On-Line Query 
system (SOLQ). SOLQ includes the same death information as 
SVES, but it provides real-time online access to this information. 


lr The prepared statement of Mr. Gray appears in the Appendix on page 63. 
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SSA responds to approximately 1.1 million CMS requests per year 
through SOLQ. 

Studies show that, overall, our death data is over 99.5 percent 
accurate, and almost 90 percent of all deaths are posted within 30 
days of the date of death. Over the last 6 years, SSA and HHS 
have been working with the States to implement an electronic 
death notification process. Death information received through this 
Electronic Death Record (EDR) system gets to us within 5 days of 
an individual’s death and is virtually error free. Currently, 22 
States participate in EDR, and in those States, EDR replaces the 
more cumbersome and labor-intensive manual process of reporting 
death information to us. We continue to work with States who 
want and are able to begin using EDR. 

In closing, let me say that timely and accurate death information 
is vital to maintaining and assuring the integrity of Federal pro- 
grams and protecting taxpayer funds. However, we can do only so 
much. We are unable to take on any additional work without ade- 
quate resources. That said, we will keep working with CMS to 
make sure that it continues to be provided accurate and timely 
death information. 

We are happy to provide the Subcommittee any additional infor- 
mation it would need on this issue, and I will be glad to answer 
any questions. Thank you. 

Senator Levin. Thank you, Mr. Gray. Let’s try an 8-minute 
round of questions for the first round. 

As I stated in my opening statement, Mr. Kuhn, our staff found 
that from 1992 to 2002, there were 33,000 deceased physicians list- 
ed by the AMA, and I am sure this is similar to what we have just 
heard about in terms of Social Security. Our staff then took a ran- 
dom sample of 1,500 of those physicians. They looked at the claims 
that were paid by CMS as to how many of those 1,500 physicians’ 
numbers, identification numbers, received payments. They obvi- 
ously did not. They were deceased. But the numbers of these physi- 
cians were used. About half, 734 of those 1,500 deceased physi- 
cians’ identification numbers were used to pay claims. Now, that is 
an incredible number. 

Who is responsible for failure to remove those physicians’ names 
from the approved list? Do you hire a contractor to do that? 

Mr. Kuhn. Yes. We use contractors to pay claims. Under the 
Medicare program, contractors run our enrollment systems as well. 
So we have contractors, but ultimately we hold the contractors re- 
sponsible. So the responsibility comes to CMS, Senator. 

Senator Levin. Ultimately you hold them accountable or you 
don’t hold them accountable? 

Mr. Kuhn. We do hold them accountable, yes. 

Senator Levin. How much money was paid to those contractors 
during this period of time? 

Mr. Kuhn. I do not have that information with me, but I would 
be happy to get that for the Subcommittee. 

Senator Levin. Well, now, we identified 33 — let me see if I can 
get you the exact number here. There were about 500,000 erro- 
neous claims for durable medical equipment that were paid during 
that period by our analysis. How many of those erroneous claims 
paid out based on erroneous identification numbers were recovered 
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from our contractors who were paid to make sure that did not hap- 
pen? 

Mr. Kuhn. I am not sure if I completely understand that ques- 
tion. 

Senator Levin. Well, we pay contractors to make sure what hap- 
pened did not happen. 

Mr. Kuhn. Correct. 

Senator Levin. When it happens, do we recover from the con- 
tractor? 

Mr. Kuhn. Oh, I see your question there. We have performance 
metrics with the contractors, and some of those performance 
metrics are enhanced by bonus payments or other things that are 
available to the contractors. So if they were not hitting their per- 
formance metrics, then it would impact the remuneration that they 
receive. 

Senator Levin. Well, I am sure there are performance metrics. 
There are hundreds of thousands of claims based on numbers that 
should not have been paid. How much recovery did we get from 
those contractors, for money we paid contractors to avoid that? 
How do we hold them accountable? 

Mr. Kuhn. I don’t know if I have that specific information on 
there 

Senator Levin. Well, about how much have we paid to contrac- 
tors for not doing their job? Give me an idea. 

Mr. Kuhn. I guess, the amount that we pay contractors across 
the board exceeds $1 billion for the Medicare program that is out 
there. But part of the issue 

Senator Levin. How much have we recovered from contractors 
for paying claims they should not have paid? 

Mr. Kuhn. Yes. And I don’t have that information, but would be 
happy to get it for the Subcommittee. 

Senator Levin. Well, about how much? 

Mr. Kuhn. I wouldn’t even hazard a guess. 

Senator Levin. Is it a common practice that we say to contrac- 
tors, “You have authorized claims that should not have been au- 
thorized under your contract. We want you to pay us back for that 
money”? Is that a common practice? 

Mr. Kuhn. Yes, that would be part of the performance metrics, 
whether we pay them or not. In terms of whether the performance 
metrics of the contract require us or allow us to go back and re- 
claim money for erroneous claims, I would have to go back and look 
at the specificity of the contracts. 

Senator Levin. Well, shouldn’t they do that? 

Mr. Kuhn. That could be something that we could do in perform- 
ance in the contracts that are out there. But, really, a lot of what 
the contractors 

Senator Levin. It could be something that we — why isn’t that an 
automatic thing? If they are given a job to do and they do not do 
it, why is there not a penalty paid by our contractors? 

Mr. Kuhn. Part of the reason for the penalty to the contractor 
is really our ability to provide appropriate oversight in this area. 

Senator Levin. It is not oversight. It is just the dates of death, 
which are provided easily to them. 
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Mr. Kuhn. Well, in this issue, and I think it begs really the issue 
in terms of some of the questions that you and others asked in the 
Subcommittee. What are the resources or the tools that we as an 
agency need in order to fulfill our responsibility to manage this 
program in an effective way? And one of the areas is really the 
Medicare Integrity Program. It is annual appropriations that we 
receive from Congress. This has been capped since 2003. We have 
asked over the last 3 years for about $300 million more infunding 
for that program in order to allow us to deal with vulnerabilities 
like this. And so when we face situations like this — and if you look 
at inflation adjusted, we are probably $90 million less than we 
were in 2003 — we have to make decisions as a program: Where are 
the worst vulnerabilities that we need to take on? And I will be 
real candid with this Subcommittee. This is an area that was not 
a high vulnerability compared to others in the program as we were 
going forward. 

So one of the things — and I really appreciate the report that the 
Subcommittee has done and want to make sure it is clear with the 
Subcommittee — is that as you ask what do we need, funding for the 
Medicare Integrity Program would be extraordinarily helpful for us 
to fulfill some of these obligations. 

Senator Levin. Some of that funding ought to come from contrac- 
tors who were not doing their jobs. 

Mr. Kuhn. And the contractors do the jobs that we give them the 
information to 

Senator Levin. They have this information. 

Mr. Kuhn. Right. 

Senator Levin. You have told them to do it. According to the In- 
spector General over here, his testimony, in responding to the rec- 
ommendations that were made back in 2001 or 2002, “CMS indi- 
cated it had developed instructions, system changes, and edits that 
would reject claims listing a deceased physician’s UPIN. CMS stat- 
ed it planned to expand the edits to include all invalid and inactive 
UPINs. In November 2001 and April 2002, CMS issued instructions 
to its carriers stating that DME claims listing a deceased physi- 
cian’s UPIN would be denied.” 

Now, you do not even know if the contract with these carriers 
has a clause that penalizes the contractor for failing to do their job? 

Mr. Kuhn. And what we do with the contractors — and I would 
go back and look at the contracts and get that information for you. 
I don’t have that information readily available to me now. But we 
send out, as you indicated, I think during this period from 2002 
through 2006, at least five instructions in this area to deal with not 
only the PINs, but the UPINs in this area. And we have the change 
requests. We gave the instructions to the contractors to execute. 
Some probably were executed better than others, I think as your 
report shows, versus Florida, versus other areas where we show 
some great variation there. But we have the information in their 
hands. Presumably they are executing. 

Where we have the difficulty 

Senator Levin. Presumably they are not executing. 

Mr. Kuhn [continuing]. Is for us to follow up to make a deter- 
mination on the execution. And, again, that is where we made a 
choice back in 2004 in terms of program vulnerabilities. We did not 
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have the resources to do the follow-up here that we needed to, Sen- 
ator. 

Senator Levin. Presumably they are not executing. Look, we 
have a small staff. Our small staff identifies, going through these 
materials, huge amounts of mistakes or payments that never 
should have been made. Do you assume, by the way, that most of 
those are fraudulent or most of those are non-fraudulent? 

Mr. Kuhn. I would like to think some are mistakes, but I sus- 
pect, knowing what goes on in the DMEPOS area, probably a lot 
of those are true fraud. 

Senator Levin. All right. So our staff, our limited staff, is able 
to do this in a very short amount of time, I mean, this is a huge 
issue here, to identify the use of the UPINs numbers of 17,000 de- 
ceased physicians. Now contractors were supposed to catch that. 
They did not catch it. We have got to go after our contractors. Will 
you? 

Mr. Kuhn. We are working with them on 

Senator Levin. Not working with them. Will you go after them 
to recover money that was paid that should not have been paid? 

Mr. Kuhn. We will go back and have conversations with them, 
but the other thing about the contractors 

Senator Levin. I don’t want conversations. I want a commitment 
from you that you are going to seek recovery from them. 

Mr. Kuhn. We will go back and exercise everything we have in 
our contracts with them. 

Senator Levin. If the contracts do not provide rights to get recov- 
ery from contractors who did not do their job because they paid 
claims that should not have been paid, will you insist that those 
contracts in the future have that provision? 

Mr. Kuhn. We will review our contracting strategy and make 
sure that is something we will work on. 

Senator Levin. Well, I have to tell you, that is too wishy-washy 
for me. Will you let this Subcommittee know what you have done 
or will do? 

Mr. Kuhn. Absolutely. 

Senator Levin. And will you let us know how much you have 
paid contractors during this period 2000 to 2007? 

Mr. Kuhn. Those are appropriate follow-ups, and we will get 
those for you. 

Senator Levin. Thank you. Senator Coleman. 

Senator Coleman. Thank you, Mr. Chairman. 

Just if I can, one follow-up on that. Do you know whether CMS 
withheld any bonuses from contractors from 2000 to 2007? 

Mr. Kuhn. I am not sure during that period, Senator, and that 
is information we could get for the Subcommittee. 

Senator Coleman. That would be another — Mr. Chairman, I 
would like to know whether we withheld any bonuses during that 
period. 

And let me just say I appreciate the cooperative relationship that 
CMS has had with the Subcommittee on acknowledging the nature 
of the problem and the new system that is being put in place. But 
the IG, even with that new system, has raised some concerns. Let 
me see if I could focus on that a little bit. 
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First, I am not sure whether Mr. Gray or Mr. Kuhn should deal 
with this, but Social Security has the data, they have the informa- 
tion. They know who is dead. It is not that complicated. You pass 
it over to CMS and their contractors. 

First, is there any question about the computer capability to 
process the Social Security data? Do we have the capacity to do 
that so that we have systems that are compatible today? 

Mr. Kuhn. We believe we do. We have actually a new inter- 
agency agreement with Social Security that was recently executed 
to be able to get this data feed in a format that will fit our enroll- 
ment system. So we think that is going to work out real well for 
us on this new system. 

Senator Coleman. And when you say agreement, I have some in- 
formation that the agreement was signed last week. 

Mr. Kuhn. Yes. That was wrapped up last week. 

Senator Coleman. And somehow could I get perhaps a little 
more of understanding why in 2008 that we are having issues 
about whether CMS can use data from Social Security that — I 
mean, thank goodness last week we got an agreement, but why did 
it take so long? 

Mr. Gray. We have been sending that information to CMS since 
2001 in exactly the same format that this new agreement will call 
for. 

Senator Coleman. So 2001 until last week, you are sending in- 
formation, but they cannot process it 

Mr. Gray. It is the exact same format. It is not changing. So, yes, 
they 

Senator Coleman. Mr. Kuhn, I just want to make sure as we 
move forward that, in fact, we have a unique opportunity. You 
have said with the new NPI system, we are going to first — again — 
we are going to clean out the system — if you are dead, you cannot 
apply. So at least we start with that. We know we have a base. 
But, on the other hand, we did this in 2002, we found out that it 
really did not clean up the system. 

First of all, I want to find out technically what we are capable 
of doing and see if there are shortcomings there. So all this data 
was coming over. What was the issue in terms of them being able 
to use the data that was given? 

Mr. Kuhn. It is interesting. We are using two different sources 
of data. When we were looking at the deceased physicians’ files, we 
were collecting that data initially from the American Medical Asso- 
ciation. We thought that was a good source document. But I think 
as we are all finding out, that was probably not as robust a system 
that we needed, and, therefore, we think the Social Security file 
will provide a much better data source for us. 

The data feeds we have been getting from the Social Security Ad- 
ministration, as Mr. Gray indicates, we have been using more on 
the beneficiary side in terms of looking at eligibility, issues like 
that. This will be the first time we have begun using this in terms 
of enrollment as well as for the NPI. And our technical staff are 
working on this interagency agreement to make sure that it comes 
in a format that is functional for us. 

I know Mr. Gray has indicated that it will be coming in the same 
exact format. Our technical folks just want to make sure this will 
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work for our systems that we have because this is a different sys- 
tem than on the beneficiary side. And we want to make sure we 
do those data matches appropriately. 

The nice thing about the NPI system is that it is a new system, 
and it is almost like the term in golf. We got a “mulligan” here. 
And what have we learned from the past in order to make sure 
that we safeguard the system as best we can? We think using the 
Social Security data will really help us do that. 

Senator Coleman. This is a $100 million mulligan. That is a 
pretty expensive one. 

Mr. Kuhn. It is big, and we are as outraged as you are about it, 
Senator. 

Senator Coleman. In terms of the new system, one of the issues, 
Mr. Vito, you talked about concerns continuing problems with NPI. 
One, you talked about controls. Can you give me a little more infor- 
mation? What type of controls do you want to see in place that you 
do not see right now? 

Mr. Vito. When we did the work in 2001, what we looked for 
were edits that would prevent claims that came in that had inac- 
tive and invalid UPINs on them. Part of that would have stopped 
the problem for deceased physician UPINs as well. What we expect 
to look at in the future is to see if the NPI system will be able to 
have edits that would prevent that from occurring again in that 
they would have claims that would come in and they wouldn’t be 
checked to see if it was a valid NPI and if it was an active NPI. 

In addition to that, another important part is that the system 
has integrity, that the data in the system is accurate. We have 
found in the past that the UPIN Registry contained inaccurate 
data. So this is an opportunity for CMS to take the new system, 
rectify some of the persistent problems and make sure they have 
good data. When they do the edits, the data has to be good in the 
program for them to run properly and for it to be effective. 

Senator Coleman. One of the issues that you raised, Mr. Vito, 
that has been of certain concern to the Subcommittee — and per- 
haps, Mr. Kuhn, you can help me understand — apparently CMS 
has for some period of time allowed providers to use their own NPI, 
their own identification number. I take it we all agree that you 
have three entities here: You have a patient, you have a physician, 
and you have a provider. And you have some measure of cross-con- 
trol when we have the physician. There is a reason for the physi- 
cian to sign that. They get reimbursed. We want to have an identi- 
fication number. 

Can you help me understand you would allow claims to be proc- 
essed without the NPI from a physician? 

Mr. Kuhn. Yes, Senator. Because we have the new NPI system 
that was brought about on May 23, on June 2 we did allow and 
will allow for a very short period of time for the supplier of the 
DMEPOS products to use their own NPI if they are unable to ob- 
tain the NPI from the ordering or referring physician. Some of 
those physicians do not have their NPIs yet. It is a new system. 
And what we wanted to make sure is that there was no interrup- 
tion in terms of services to Medicare beneficiaries. Had we had a 
hard and fast rule, we think we would have created some access 
issues for Medicare beneficiaries out there. 
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Having done that, we knew that we were creating a program 
with vulnerability, but when we made this decision, we told all 
those suppliers that are going to use their own NPI, “Do it at your 
own risk, because if you do, be sure that you are on our list for 
post-payment review.” And I hope people hear this loud and clear, 
that we will be going to those suppliers that use their own NPI to 
make sure that they are candidates for post -payment review. That 
is the other side of the ledger to make sure that we have integrity 
for this short-term fix in order to assure access to beneficiaries. 
And that is why we did it. 

Senator Coleman. And I understand the value of getting access 
to beneficiaries. In terms of being unable to obtain, other than a 
physician not having the new NPIs, is there any other reason why 
a provider would not be able to get a NPI number from a physi- 
cian? 

Mr. Kuhn. It might be that they might not be communicating 
well between one another. There could be other kinds of process 
reasons. But we hope that this is truly the exception to the rule. 
But we think the fact that those that do use it will be subject to 
post-payment review, we think we can 

Senator Coleman. But here is the problem you have with that. 
What we have seen with DME, what we have seen with this pro- 
gram is that this has been a cash cow, an ATM machine for fly- 
by-night players. In our discussion with some of the folks who have 
been convicted, they talk about passing around UPIN numbers. 
Why do drug deals when you can get long sentences and go to a 
tough place, when you can simply create a DME operation, submit 
claims? And in this case, if you have fly-by-night suppliers, folks 
who are not going to worry about any post-payment review, aren’t 
we setting ourselves up for a period of time in which folks simply 
want to cash in knowing that all you have to have is your own 
number? How do you protect against that? 

Mr. Kuhn. Senator, your point is well taken. It is a vulnerability 
to the program. But it is a balance between making sure bene- 
ficiaries have access and making sure that through the post-pay- 
ment review we think that is the best check we could put in place 
here. We could have sided on the other side of the ledger, but then 
I think our goal here is to serve the beneficiaries, and we thought 
we were serving them well by doing that. 

Senator Coleman. And I appreciate that. My concern is that, 
again, other than a physician not having the number in which you 
could then put in an old number, which other than that, the idea 
that “there is any difficulty” — I mean, part of this system requires 
that you can get reimbursed by the Federal Government for either 
something to do with durable medical equipment — and you talked 
about prosthetics and others, by the broader phrase there — that a 
physician has to say this is going to be reimbursable. And so for 
a provider to say they are having difficulty, it is their responsibility 
if they want to get paid. Why wouldn’t we put the burden on them 
to do that? 

Mr. Kuhn. Well, the other part of this is that while in that par- 
ticular field there would be the NPI for the referring or prescribing 
physician or the particular entity’s NPI, it still does not — it still 
needs to have all the documentation there and for some that they 
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are going to get what is called a Certificate of Medical Necessity 
(CMN). There needs to be a prescription. The other documentation 
needs to be there as well. 

So, again, that gives us the opportunity to deal with the post- 
payment reviews. 

Senator Coleman. Thank you, Mr. Chairman. 

Senator Levin. Thank you very much, Senator Coleman. Senator 
Carper. 

Senator Carper. Thank you. 

Dr. Coburn and I held a hearing about 2 weeks ago. We invited 
a number of folks to come in and testify, including David Walker, 
who until very recently was the Comptroller General of our coun- 
try. And we asked them to look way down the road at the kind of 
fiscal challenges, budgetary challenges that we are going to face. 

I think one of our witnesses mentioned that within maybe 25 
years or so, we are going to be spending about 18 percent of GDP 
in this country just for three programs: Social Security, Medicare, 
and Medicaid — 18 percent of GDP. The reason why that is alarm- 
ing is because historically in the last decade or two, we spent about 
18 percent of GDP to run the whole Federal Government. And we 
are looking in our lifetime at a time when we will be spending 
about that much just to run those three programs — nothing for the 
environment, nothing for transportation, nothing for space, nothing 
for food programs. I mean, it is not just alarming. It is scary. 

One of the reasons why we are all over this issue and other 
issues — and Dr. Coburn and I are going to drive people crazy before 
we leave here on improper payments. But we are going to make 
sure that improper payments come down, most of which are over- 
payments. And we are going to make sure to the extent that im- 
proper payments are made that we go out there and recover the 
money that has been mis-paid or overpaid. 

One of the things that we are looking at in the legislation that 
he and I have co-authored to change the improper payments law 
is how might we penalize agencies that are not making progress in 
addressing their improper payments problems And I might add, 
Senator McCaskill has been all over this with us. She has been just 
a great partner in this issue. But in addition to having sticks, we 
want to have a couple carrots in this as well. 

And you started to say, Mr. Kuhn, in response to what the Con- 
gress can do to better make sure that you all are doing your job — 
let’s return to that for a second. What can we do? And I think you 
were saying something about funding for the Medicare Integrity 
Program. Just go back to that. What can we do to help make sure 
that you are doing your job so that a year from now when we have 
you back, and we say, well, what is different now, you have a much 
better story to tell us? If you do not, I would not want to be in your 
shoes. 

Mr. Kuhn. I thank you for that question. Two or three observa- 
tions I would make for you on that point. 

One is the Medicare Integrity Program, it has been capped since 
2003. If you look at inflation growth, we are probably $90 million 
less than we were in 2003, and our requests have been for about 
$300 million over the last 3 years, which we have not seen that 
funding. And so when you really think about our ability to manage 
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these programs and deal with the integrity and the fraud and 
abuse, full funding in that area, I think, would be extraordinarily 
helpful for the agency in order to fulfill our work in this area. 

Senator Carper. Let me just interrupt for a second. I think in 
our legislation, we provide the opportunity for agencies to retain 
some of the monies that they recover and to be able to use those 
monies for better financial management. Would that be of help? 

Mr. Kuhn. That would, in fact, and we have a pilot, which I 
think you referenced in your opening comment, the recovery audit 
contractors, which we did pilots in three States and then ultimately 
six States, and we hope to launch nationally here very soon, which 
really go back to providers and look at improper payments and the 
recoveries. They captured in that period of time about $1 billion in 
those three States. We think they were good, and there might be 
opportunities to retain some of that funding to fund some of the 
program integrity area. 

And then, finally, I think another important tool for us will be 
something that Dr. Coburn talked about earlier, DME competitive 
bidding. The real issue — there are two sides to this ledger, as we 
were talking about earlier. One is these invalid numbers, to make 
sure that we do things well on the front end. I think the folks in 
law enforcement will tell you it is kind of like health care. You 
want to prevent something, a disease from happening before it hap- 
pens. The same thing with fraud and abuse, you want to prevent 
it before it occurs. So having these good quality numbers can hope- 
fully prevent some of this stuff from happening. 

But on the back side, we have to have legitimate suppliers out 
there to make sure that they are valid, and DME competitive bid- 
ding gives us a new set of tools to deal with that in terms of ac- 
creditation, quality standards, financial standards, plus by holding 
an auction, we can get pricing where it needs to be. Under the 10 
demonstration areas that we are looking at right now, or the pilot 
areas, we brought prices down by about 26 percent across the 
board. That is real savings to the program, and it shows that when 
you mis-price something in this program, that brings the fraudsters 
in. 

So I think competitive bidding, the issue of the recovery audit 
contractors, and ultimately funding for the MIP program would be 
very helpful to the agency. 

Senator Carper. All right. Thank you. 

One of my core values in our office — and a core value when I was 
governor and running State administration in Delaware — was to 
really focus on excellence in everything we do. I used to say, “If it 
is not perfect, make it better.” And I think we have a real oppor- 
tunity to do just that with the recent switch over to the National 
Provider Identification for all of Medicare’s providers. You have got 
basically a clean slate right now, and my concern is that it stays 
that way. 

Let me just ask, what is your agency doing to take advantage of 
this fresh start? You spoke to this at least indirectly, but let me 
ask it again. What is your agency doing to take advantage of this 
fresh start to ensure that the registry does not face the same kind 
of problems that its predecessor did? How do you plan to incor- 
porate some of the report’s recommendations? 



26 


Mr. Kuhn. I think the point is well taken, and I think you are 
right. We have this unique opportunity here that you do not really 
see in government too often, where we have a fresh start for a pro- 
gram that began on May 23, and then the value of this report that 
the Subcommittee has put forward, because it really puts in place, 
as you talked about excellence, the basic engineering model — that 
is, let’s identify the gaps, let’s address those gaps, and let’s improve 
as part of the process. 

So a couple of the real improvement areas, of course, is going to 
be the new data match agreement we have with the Social Security 
Administration to make sure that we deal with that issue effec- 
tively. 

A second improvement that we are looking at, again, based on 
resources, is a periodic validation process in terms of all the pro- 
viders that have come in with new NPIs that are out there. We es- 
timate right now that about 25 percent of physicians have some 
kind of change in terms of their NPI or their enrollment process 
over a 5-year period, and we want to do periodic validations to keep 
that system as robust as we possibly can. 

Another new edit we want to put in place is to make sure that 
the referring or ordering physician actually is an enrolled provider 
in the Medicare program, and we will have a cross-check that will 
make that happen as we go forward. 

And then, finally, to make sure, at least on the DMEPOS side, 
we have an enrollment contractor that is doing the work there. 
That contract has now changed. It is a new contract that was let 
just a couple weeks ago, where before they mostly focused on en- 
rollment, now they are going to be looking at enrollment and fraud. 
And their follow-up, their on-site inspections of these facilities out 
there to make sure they are legitimate businesses out there is 
stepped up dramatically, and I think that will help us as well. 

Senator Carper. All right. GAO has told one of our subcommit- 
tees that Dr. Coburn and I serve on — that Medicare Advantage and 
the Medicare Prescription Drug Benefit Program are likely commit- 
ting substantial improper payments. These programs did not report 
their improper payment estimates for fiscal year 2007. They did 
not report them for 2006 or 2005 either. Nor did they provide a tar- 
get date for when they would be providing that information. In 
fact, they were the only two programs identified by GAO who did 
not give a time frame — the only two in the whole Federal Govern- 
ment that I am aware of. 

When does CMS plan on releasing this information? And does 
your agency have any set goals for reducing improper payments 
with respect to those programs? 

Mr. Kuhn. Senator, I am not familiar with that particular report 
or the timetables there, so I would like to get back to you with that 
information and to kind of understand behind that a little bit in 
terms of the improper payments because under those particular 
programs they are paid to an entity, and then they have separate 
contracts with the providers. So if it is an improper payment that 
we are making to the MA plan or PDP, that is one issue. If it is 
their contractual relationship with the providers, that is something 
else. And I would like to understand a little bit more, and we could 
get back to you in writing on that one. 
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Senator Carper. Thank you. The improper payments law has 
been around for less than a decade. Finally, I think most of the 
Federal agencies are actually complying, a couple of big ones — De- 
partment of Defense, Homeland Security. A couple programs I just 
mentioned do not. Not only are they not out there recovering im- 
proper payments, they are not even reporting what their improper 
payments might be. And before we can go out and recover, we need 
to know, the agencies need to know, some idea of what the mag- 
nitude of the improper payments is, and then we need to go to 
work and recover as much of that money as we can. I will look for- 
ward to your responses. 

Again, I just want to say to Senator Levin, to Senator Coleman, 
and to your staffs, thank you very much for your diligence and 
bringing us to this hearing. Thank you. 

Senator Levin. Thank you, Senator Carper. Dr. Coburn. 

Senator Coburn. Thank you, Senator Levin. 

Mr. Kuhn, I want to go back to something. You did not answer 
Senator Levin’s question, and before you leave here today, I think 
you — it is unbelievable that we would have contracts with Medicare 
service organizations that are not held responsible. And I have a 
very direct question for you. Will you make sure that in the future 
all contracts with all these service companies, these payers, have 
a section in there in which they are culpable and held responsible 
for overpayments which they should have avoided? 

Mr. Kuhn. Senator, I thank you for asking that question again, 
and here is what I will follow up and do. One, I am going to go 
back and sit down with our General Counsel to look at existing 
contracts to see if they include those provisions and did we exercise 
those clauses appropriately in terms of collecting improper pay- 
ments. And then on a go-forward basis, we will engage with our 
contracting process to make sure that the Federal Acquisition Reg- 
ulations out there, FAR contracting and all that, to make sure that 
we are properly exercising contractual arrangements; that if there 
are improper claims made, that we are meeting all Federal stand- 
ards to go forward. So I will make sure 

Senator Coburn. I am not sure that is a yes. The fact is that any 
American looking at this hearing today would say Medicare is con- 
tracting with service providers, and you have not told us, yes, we 
will hold them accountable. And what I want is an answer, yes, we 
will hold them accountable. 

Mr. Kuhn. To the extent we can, we will. The reason I equivo- 
cate a little bit is I just do not know all the provisions of the FAR 
contracting rules. But if we can hold them accountable, yes, sir. 

Senator Coburn. You can hold them accountable. And if you can- 
not, we have to change those rules. It is ridiculous. If you cannot 
hold a contractor accountable for doing something because of some 
silly regulation that we have written in contracting rules, then we 
need to know that and change the rules. But the fact is that we 
know $80 billion in waste, fraud, and abuse is in Medicare, and 
that $16 billion — I misspoke earlier when I said $200 billion. It is 
$16 billion that is coming out of the pocket of Medicare payers. In- 
dividual Medicare recipients are paying $16 billion more than they 
should be. So what we need is a commitment. 
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The second thing I would like to ask that you supply the Sub- 
committee with is a list of all the service contractor providers and 
their 10-Ks to this Subcommittee. In other words, here is the list, 
here are the companies, and here are their 10-Ks, and you provide 
that, because we are going to be wild by the time you see the prof- 
itability of the people who are your service contractors, and then 
we compare that to this fraud, it is a drop in the bucket to hold 
them accountable in terms of their profitability. 

Senator Levin. Well, we ought to get an answer to that. 

Mr. Kuhn. Yes, sir. We would be happy to supply that informa- 
tion to the Subcommittee. 

Senator Coburn. Thank you. 

Did I understand your testimony that you only cross-reference 
this list in the past as far as dead physicians every 15 months? 

Mr. Kuhn. That is correct. That was the instructions. 

Senator Coburn. Is that changing? 

Mr. Kuhn. That will change — depending on what we come up 
with with Social Security, whether it is now weekly, monthly, but 
it will — the periodic rate of that will be accelerated greatly under 
the new NPI system. 

Senator Coburn. It ought to be every week. I mean, that is 
punching a button on a computer cross-checking a list. 

Mr. Kuhn. Right. 

Senator Coburn. So why is that not just common sense that we 
are going to do this every time we get a list? 

Mr. Kuhn. That is right. Under the new interagency agreement, 
it is my hope it will be weekly. But weekly, monthly, biweekly, the 
periodic rate is going to be much quicker. 

Senator Coburn. Now, one other thing you said, Mr. Kuhn, in 
answering questions for Senator Carper was the problem of not 
cross-checking whether you had — even though you had a UPIN 
number or a new NPI number, not knowing whether they were en- 
rolled providers? Have we not been checking against enrolled pro- 
viders all this time? 

Mr. Kuhn. No, we haven’t. In fact 

Senator Coburn. OK. That is — just think about that for a 
minute. People who are not enrolled to provide for Medicare, we 
are paying DME suppliers for prescriptions from people who are 
not qualified to give those prescriptions? The question I would have 
is why haven’t we. 

Mr. Kuhn. There are rare exceptions in the program, changes in 
the future, where there may be a physician who has elected not to 
participate in the Medicare program. But they are licensed in the 
State. They can practice in the State. But they see a Medicare ben- 
eficiary who signs an Advanced Beneficiary Notice (ABN), and 
says, “I am going to self-pay because I want to come to this doctor. 
I have been seeing him for years,” and they write him a prescrip- 
tion. We have filled those prescriptions for that particular indi- 
vidual as a result of that relationship with that physician. 

Senator Coburn. Fine. That is the exception to the rule. 

What about the people who are off the Medicare list who have 
been sanctioned and still have a UPIN number and still have a 
NPI number? You are not cross-checking against those people for 
writing prescriptions for DME equipment? 
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Mr. Kuhn. Not under the old system. Under the new one we will. 

Senator Coburn. OK. Mr. Vito, on page 9 of your testimony, 
when you looked at the UPIN database, you found 52 percent of 
the providers in that database had inaccurate information in at 
least one category, and 17 percent of those providers no longer 
billed Medicare from any of the practice settings listed in the UPIN 
file. 

Now, does that mean they were not practicing or they just were 
not at the location at which the UPIN file listed them? 

Mr. Vito. I don’t know that answer. We would have to go back 
and look. I think sometimes that they might not have been prac- 
ticing at that location. 

Senator Coburn. And of that 17 percent, 14 percent were de- 
ceased? 

Mr. Vito. That is correct. 

Senator Coburn. And 26 percent were retired? 

Mr. Vito. That is correct. And we found that out because we 
asked the physicians about their info. We got the information from 
the UPIN directory. We asked the actual physician. We found that 
information because either when we asked at the practice they told 
us that the physician had died or a family member told us that 
they had died. 

Senator Coburn. So what that means is at least 6 percent of the 
total UPIN numbers are lousy numbers because they either rep- 
resent retired physicians or physicians who no longer participate in 
Medicare or are no longer at the practice site which they sup- 
posedly are supposed to keep updated with Medicare. Correct? 

Mr. Vito. I believe there are problems with that database. There 
were problems with that database, and we pointed that out. But I 
think the point is that there was never any check at all for the 
UPIN other than it started with an alpha, then either had an 
alpha or a numeric in the next two digits, and the following three 
digits were just numeric. 

Senator Coburn. So there was no integrity to the list in terms 
of the quality of the UPIN? You didn’t know, even though you had 
a UPIN number, that may have not represented the 

Mr. Vito. What I am saying, when they processed the claims, 
when the claim came in, they didn’t match it up to see if it was 
an actual 

Senator Coburn. A good number. 

Mr. Vito. Yes. 

Senator Coburn. OK. Mr. Kuhn, do DME equipment providers 
who use dead physician numbers get sanctioned by CMS? 

Mr. Kuhn. Yes. 

Senator Coburn. Explain the sanctioning process. 

Mr. Kuhn. When we are aware of that, it can come about in a 
number of different ways. One, revocation of their ability to work 
with the Medicare program. They are out of the program. And then 
where we see cases like this, we refer them over to our law enforce- 
ment partners — IG, Department of Justice, others — for follow-up 
and case development if there is outright fraud there and for pros- 
ecution. 

Senator Coburn. Can you give me a situation where a dead phy- 
sician’s prescription would not be outright fraud? 
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Mr. Kuhn. I think there is a possibility. This is a credible hypo- 
thetical, but it is plausible, I guess, where someone wrote a pre- 
scription one day, the physician, the next day was in a car acci- 
dent. 

Senator Coburn. OK, so within a month, let’s say. After a 
month, can you give me a situation in which a DME supplier could 
logically use a dead physician’s UPIN number without trying to 
commit fraud? 

Mr. Kuhn. Without a month, 60 days, I think you are probably 
looking at fraud, or perhaps a mistake, but certainly more likely 
fraud. 

Senator Coburn. So why would not all of them be completely 
sanctioned and banned from Medicare for that? 

Mr. Kuhn. They should be, and when we work up those cases, 
I think there should be absolutely revocation as part of that proc- 
ess. And what we are pleased about is that with our new con- 
tractor, our new contract in terms of those that do enrollment for 
DME suppliers, this is going to be one of their new charges, to 
make sure that we are even better policing that, because you are 
absolutely right, there is the one side in terms of making sure 
these numbers are good. But if we still have bad suppliers out 
there, they are going to try to find a way to commit fraud against 
us, and we have got to work both sides of that ledger. 

Senator Coburn. Would you kindly forward to the Subcommittee 
the number of fraud causes that you — or the number of sanctions 
that have been banned from the program in the last year of DME 
suppliers? 

Mr. Kuhn. Sure, we would be happy to. 

Senator Coburn. And the number that also have had dead physi- 
cian prescriptions that have not been banned from the program? 

Mr. Kuhn. We would be happy to get that information for you. 

Senator Coburn. Thank you, Mr. Chairman. 

Senator Levin. Thank you, Dr. Coburn. Senator McCaskill. 

Senator McCaskill. Thank you, Mr. Chairman. 

I am curious with this new system, the NPI system. Obviously, 
I am beyond alarmed that you have allowed these folks to make 
claims without a NPI number from the doctors. Could somebody ex- 
plain to me why you wouldn’t give the doctors NPIs before you give 
the providers NPIs? 

Mr. Kuhn. We do, and I think it is the issue in terms of us allow- 
ing how they use their own NPI in that field in terms of referral 
and prescription. Is that your question? 

Senator McCaskill. Yes. I mean, as of June 2, you are allowing 
DME suppliers, durable medical equipment suppliers, to use their 
own NPIs rather than the prescribing doctor. And the issue, I was 
told, is that because there were some order physicians that did not 
have their NPIs yet. 

Mr. Kuhn. Right. 

Senator McCaskill. Well, why would you give them to any pro- 
viders before you give them to all the doctors? 

Mr. Kuhn. Here is the way that scenario works. Everybody ap- 
plies for a NPI. They get their NPI. The physician or his office 
manager, his or her office manager, might not readily have it. They 
might not have applied for it yet, but they still are practicing in 
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the community, been there for 20, 30 years, whatever the case may 
be. What we were concerned about here is we know this created 
a vulnerability in the program. But we were also trying to balance 
that against access for Medicare beneficiaries to make sure that 
they could get the supplies and services that they needed. This is 
a temporary patch, but the key here, as I mentioned earlier, is that 
anybody that uses their own NPI in that field, any supplier, they 
are a very good candidate for post-payment review as a result of 
this scenario. 

So, yes, they have the opportunity to use it if it is a true access 
issue. But if you do use it, beware, we are going to come and look 
over your shoulder. 

Senator McCaskill. Do you get the Social Security number of 
the prescribing doctor if there is not a NPI for the prescribing doc- 
tor? 

Mr. Kuhn. We have that information in terms of the enrollment 
process. That is correct. 

Senator McCaskill. OK. So for every single claim that is coming 
in from a provider where there is not a NPI for the doctor, are you 
running it through the Social Security database to make sure that 
the doctor is alive? 

Mr. Kuhn. Yes, on enrollment, yes, we do. 

Senator McCaskill. No. I am asking on these claims. You have 
stopped segregating duties. 

Mr. Kuhn. Right. 

Senator McCaskill. We have a program that cannot figure out 
for 6 years how to match the Social Security numbers of the doc- 
tors with the information you have been getting from the Social Se- 
curity Administration. You have been getting the Social Security 
information for 6 years. You cannot figure out how to do that. 

If someone is making a claim for durable medical equipment 
with a NPI without a doctor’s NPI, you have that doctor’s Social 
Security number; before you pay that claim, are you running it to 
make sure they are alive now, this minute? 

Mr. Kuhn. We are not right now. 

Senator McCaskill. OK. So why not? 

Mr. Kuhn. We are making those systems changes. Those will be 
system changes that we hope will be in place by the end of this 
year or early next year as part of the process. 

Senator McCaskill. OK. Clearly, the cart is before the horse 
here because this seems to me that at a minimum, if you are going 
to allow these people to use their own numbers, you have to have 
another safeguard in place in terms of prevention. With all due re- 
spect, Mr. Kuhn, you came to this hearing not even knowing if you 
have a mechanism to hold these contractors accountable. You don’t 
even know if it is in the contract or not. That has not even gotten 
on your radar screen until some very pointed questions from this 
Subcommittee. That does not give me comfort that the priorities 
are in terms of looking at how we prevent fraud, waste, and abuse. 

Let me ask you about this $300 million that you currently get 
for the Integrity Program. Who is in charge of it? 

Mr. Kuhn. Our Office of Financial Management and our Pro- 
gram Integrity Group. 

Senator McCaskill. Who is the person in charge of the program? 



32 


Mr. Kuhn. Program Integrity is run by Kimberly Brandt. 

Senator McCaskill. Kimberly Brandt is in charge of a $300 mil- 
lion budget to make sure that bad guys are not ripping us off? 

Mr. Kuhn. No, let me correct the numbers here. Right now we 
get $720 million for Program Integrity. That number has been fro- 
zen since 2003. Over the last 3 years, we have requested additional 
funding to the tune of $300 million in that area. Overall, that pro- 
gram is run by our Office of Financial Management. That is run 
by a gentleman by the name of Tim Hill. And then a particular 
group within the Office of Financial Management is the Program 
Integrity Group. They run many of the program integrity issues, 
but those dollars are also used in terms of audit function, different 
organizations within the Office of Financial Management. 

Senator McCaskill. Well, so now what you are telling me is we 
are spending $720 million — and you want $1 billion — to make sure 
people are not stealing from us. 

Mr. Kuhn. That is correct. 

Senator McCaskill. OK. That gives me a headache. That means 
that we are spending $1 billion on top of all the people who work 
there, on top of the IG and the GAO, we are spending $1 billion — 
you want us to spend $1 billion. We are spending $720 million. 

Mr. Chairman, I think it would be a really good idea to have a 
hearing and talk to these integrity people. I would love to know 
what they are doing. I would love to see an org. chart. Could you 
provide to the Subcommittee an org. chart of how the $720 million 
is being spent? 

Mr. Kuhn. Happy to. 

Senator McCaskill. And I would like to know how many people 
it is paying for. I would love to know how many contractors we are 
buying with that money. And what are they doing? The idea that 
you would be spending $720 million a year and for 6 years nobody 
has checked the death database at Social Security for doctors? Talk 
about needing to fire some people. 

Mr. Kuhn. I think that is a fair question. But I think as I tried 
to share with the Subcommittee earlier, we face on a regular basis 
a number of vulnerabilities in the program. In 2004, when we were 
going to do the follow-up checks in terms of this issue of the de- 
ceased physician files that were out there, here is what we were 
looking at in 2004: We had a major scandal going on in this coun- 
try with the issue of powered mobility devices or powered wheel- 
chairs in certain parts of the country, to the tune of about $1 bil- 
lion being ripped off from the Medicare program. With law enforce- 
ment, we launched a major initiative called Operation Wheeler 
Dealer. We threw resources in that direction. 

We had the new enrollment program, the PECOS system that 
came up. We moved resources in that direction. We had, on the 
heels of the Medicare Modernization Act, the new Part D program, 
and we wanted to make sure that was secure and up and running 
before it got out of the gate. 

So we make tough choices in terms of areas of vulnerability. This 
is an important area, but at that time when we were making these 
decisions, there were things that were much higher for us to put 
resources on. These are tough choices, but these are the decisions 
we made. 
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Senator McCaskill. Well, all of the money that you are throwing 
to these various programs is addressing fraud that has occurred as 
opposed to investing that money, integrating this money into pre- 
vention. And this hearing today is a drop in the bucket. I realize 
that. But it is a symbolic drop in the bucket in terms of, we are 
chasing the cow after it gets out of the barn rather than doing 
some pretty simple checking on that lock on the barn. And, if there 
are $720 million worth of people at Medicare that are supposed to 
be fixing the lock on the barn, then the very basic would be some 
of the things that clearly have not been done. 

I am curious that the Integrity Section, how they felt about you 
guys using NPI numbers for people providing the equipment as op- 
posed to the doctors that were prescribing it. Did anybody over 
there scream? They should have. That should be something they 
should be reviewing. Everything should be going on at the front 
end, not at the back end. 

Of all the dead doctors we have found who prescribed DME after 
they had been dead a month, how many of those have been re- 
ferred for prosecution? How many of those providers have gone to 
jail? 

Mr. Kuhn. We are hoping to get the information from the Sub- 
committee in terms of the report. In the report, I think they iden- 
tify one DME supplier. I did not see that they identified any physi- 
cians by name, but we hope to follow up with the Subcommittee to 
get their files, their identification. And I have asked staff, once we 
get that, to pursue active investigations in these areas and recov- 
eries where we can. 

Senator McCaskill. What I would certainly like to see is if you 
all can do this without us passing a law demanding you do it. Is 
there any reason that every time you find a prescription that has 
been filled for a doctor who has been dead for more than 30 days 
that you cannot send a letter to the Attorney General in that State 
saying, “We have evidence of fraud. Go for it?” 

Mr. Kuhn. That might be a nice improvement to have as part of 
this process. I like that suggestion. I will take that back. 

Senator McCaskill. Yes, and the $720 million worth of staff 
over at the integrity place, I would be curious why they have not 
demanded that you be doing that. You have 50 Attorneys General 
out there that are staffed and ready to handle these cases, and I 
know that it is a big deal in my State, and local prosecutors, too. 
Everybody wants to go after people that are preying upon sick peo- 
ple and undermining the Medicare program. 

I know my time is up. Thank you, Mr. Chairman. 

Senator Levin. Thank you, Senator McCaskill. 

We have asked you for a number of reports. Can you assure us 
we will have those reports in 30 days? 

Mr. Kuhn. We will do our level best to get it to you in 30 days. 
If we are unable to, we will inform you accordingly and give you 
a time certain when we think we can deliver the information. 

Senator Levin. Fine. Now, let’s just take maybe 3 minutes each 
because we have some roll call votes coming on the Senate floor. 

You indicated, Mr. Kuhn, that CMS had a problem in terms of 
the data that was coming in. You apparently suggested that the 
AMA data was faulty. Now, the data that our staff looked at were 
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your files. In your files, the prescription dates came after the dates 
of death. 

Mr. Kuhn. I think the issue is not that it was faulty, but it was 
not as robust as 

Senator Levin. Forget robust. That is, 734 out of the 1,500 cases 
were in your files. 

Mr. Kuhn. Right. 

Senator Levin. It does not take much. Look, I am not a high-tech 
guy, but it does not seem to me it is very complicated for software 
to be written that says if there is a date of death in your file, you 
do not pay claims. 

Mr. Kuhn. Oh, I do not dispute 

Senator Levin. What is complicated about that? 

Mr. Kuhn. I do not dispute that the matches weren’t made as 
good or 

Senator Levin. Not “as good.” The claims should not have been 
paid. 

Mr. Kuhn. But, again, a lot of it is the thing that we have got 
to have good data sources. I know when we talked to the staff 

Senator Levin. No. I am sorry. I have to interrupt you. I have 
only 3 minutes. This is not good data. So this is your data. This 
investigation by our staff looked at your files. In your files, the date 
of death was present. For the 1,500 we looked at, that random 
sample, in half of those deceased physicians there were payments 
made. Those 1,500 cases had dates of death in CMS files. It is not 
a matter of getting information from Social Security or from AMA. 
Your files had the date of death. How complicated is it for someone 
to write a program that says in your files where there is a date of 
death, you hold off paying any claims? Why is that complicated? 

Mr. Kuhn. I cannot imagine why that should be so complicated, 
and I do not understand why that one was not corrected. I will look 
into that one personally. 

Senator Levin. Why does that take $300 million to do? 

Mr. Kuhn. It was an issue of priorities at the time, what we 
were 

Senator Levin. But there is no dollar priority. That is a software 
issue. That is just writing a simple software program that says do 
not pay a claim where there is a date of death in CMS’ files for 
a physician. 

Mr. Kuhn. Senator, it is tough calls. If someone is stealing a bil- 
lion dollars here, someone 

Senator Levin. Go after the billion dollars. 

Mr. Kuhn. We are going to go after the billion dollars. 

Senator Levin. I am with you, but could you get $1,000 for some- 
one to write a program? 

Mr. Kuhn. We will see what we can do to chase the others. 

Senator Levin. No. It is not chase the others. It is to write a pro- 
gram in your own file which says if there is a date of death in your 
file, you do not pay claims. That is not a complicated, expensive 
deal. So I do not think it is good enough for you to say, well, you 
have asked for $300 million more above the $700 million that you 
have not gotten when that is a simple software cure. 

Mr. Kuhn. The only thing I can answer, Senator, is that we have 
to make choices with limited resources. We made some choices on 
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vulnerabilities here. I understand that this sounds simple, but we 
made some choices in 2004, and this is the choices we made. 

Senator Levin. You mean you looked at this possibility and de- 
cided not to do it? 

Mr. Kuhn. We looked at where we had program vulnerabilities, 
and as I said, $1 billion, chasing those that were stealing on power 
wheelchairs, the new PECOS system, the new Part D program is 
where we put our resources. 

Senator Levin. I would agree with that decision to put resources 
there. What I am telling you is this is not a complicated thing. This 
is writing software, a program, which is not complicated. This is 
not a matter of making sure the data that comes in from Social Se- 
curity or AMA is accurate and up to date. This is where your file 
has that record in there that there is a physician that has died and 
where you have not automatically then said no payments based on 
that identification number. 

Mr. Kuhn. And I appreciate that distinction. 

Senator Levin. I have to tell you, I just do not find your testi- 
mony credible in this regard. To talk about other needs that you 
have to go after — the wheelchair frauds — I agree with you, if it is 
a matter of either/or, you do it. But this is a very simple fix, and 
I do not get how you can defend not doing it and how you do not 
know whether or not the contract that you signed with contractors 
who are supposed to implement this program contains a provision 
that holds them accountable for failures to do their job. On all 
those items you mentioned, looking forward, you have to have ac- 
countability in there. And that is what has been missing, and it is 
still missing. There is no accountability for failure to do people’s 
jobs. That to me is a huge gap, and it is a gap in too many pro- 
grams, too many government programs, where people, including 
our contractors, are not held accountable for not doing their job. 

I would add that to your program as the No. 1 item that you 
ought to have in any new program. 

Senator Coleman. 

Senator Coleman. Thank you, Mr. Chairman. 

First, just to go back to the issue of the DME providers providing 
a number and not the physicians. Again, I stress the concern with 
the fly-by-night folks, that a post-payment review is not going to 
be of help for those folks who are doing this to rip off the system. 
We know that they are out there. Then we have contractors that 
do the review. That costs money. 

My strong suggestion is that as you go back, you look at putting 
a guard at the front door. It goes back to the issue the Chairman 
raised and I raised in my opening statement. I talked about things 
that UPS does and FedEx does. It is the ability with computer ca- 
pability today to be able to check things. You would think that 
there would be some kind of automated system at the front door. 
So I would urge you to go back because I do not want to be back 
here in another year looking at what happened in that period 
where we did not require the new NPI from physicians. 

Second, it would appear that if we have dead physicians, there 
was obviously no system in place to check against treatment visits. 
In other words, CMS has information from treatment visits. Physi- 
cians are being reimbursed for that. So, again, where we are today, 



36 


we have to look back and you see all these years of payments with 
this — it was then a UPIN, but I would presume that there would 
be a big blank for many years about any treatment visit because 
there is no physician. Why doesn’t CMS cross-check claims with 
DME for doctor visits? 

Mr. Vito, I would turn to you. Would that be another piece of the 
way in which we ensure greater integrity by doing — again, at the 
press of a button. I have to believe that you can press a button, 
and it may be more expensive than $1,000. It probably costs money 
to do this. But we are paying contractors to do it. This is not the 
government’s limitation. We have lots of money in the private sec- 
tor. What am I missing in having a cross-check of treatment visits 
to physicians in looking at DME payments, claims? 

Mr. Vito. Well, there are two different systems at CMS. There 
is the DMERC, the DME system, and also the Part B system. And 
sometimes they are not housed together. But when we do reviews 
and when we look at billing patterns for aberrations involving 
UPINs, we look at the beneficiaries. Then we also look to see if 
there were any Part B bills indicating that they had an office visit 
at the time that they were supposed to have gotten an order for 
this equipment. 

Senator Coleman. But that is my point. I would presume that 
is what you do, and in this day and age, where we have such capa- 
bility electronically, it shouldn’t matter where you are housed. It 
shouldn’t matter. That is of no relevance today. It is a question of 
whether we want to ensure that the right hand knows what the 
left hand is doing. And so it all goes to this issue of what kind of 
capability do we have today to be able to provide — not waiting for 
you to come in after the fact, Mr. Vito. And I appreciate it — I do 
not want to put you out of a job. But it would be nice if you would 
have less to look at because you are doing what I believe could be 
done up front. 

Mr. Vito. Right. The only issue here is that they are not even 
editing for the most basic format. CMS did not edit for the most 
basic edit of just seeing if the UPIN was active. You are talking 
about even doing more, which would be even more computer capa- 
bilities and requirements because you would then have to match it 
up onto the Part B system. What I am saying is we could start by 
taking first steps and build upon those first steps to make it so 
that we would have a system that certainly has more integrity and 
does more checks. We will be glad to work with CMS and you to 
make sure that happens. 

Senator Coleman. I appreciate that, Mr. Vito. Thank you, Mr. 
Chairman. 

Senator Levin. Thank you. Dr. Coburn. 

Senator Coburn. Thank you. I am starting to get a little worried 
that CMS’ computer systems are like the Pentagon’s, and it is scar- 
ing me to death. Am I hearing you right that there is no cross-ref- 
erence capability between Medicare Part D, CME, Part B, and Part 
A to talk to one another? 

Mr. Kuhn. Probably 5 years ago there was not, but there is now. 

Senator Coburn. All four of those, you can run cross-checks all 
the way across — eligibility, UPIN numbers, date of birth, certifi- 
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cation, enrolled doctors, certified suppliers — all that can be cross- 
referenced? 

Mr. Kuhn. My understanding is that with the changes — let me 
even back up, a little more history here. Part of the Medicare Mod- 
ernization Act gave us authority to do contractor payment reform, 
something that the agency has wanted to do for 20 years of this 
whole legacy system that we had out there. And so we got rid of 
the fiscal intermediaries; we got rid of the carriers; we got rid of 
the DMERCs. All those folks are gone now, and basically we are 
creating what we now call Medicare Administrative Contractors 
(MACs), which for the first time brings Medicare A and B together. 
Those systems now talk to one another. They work together. 

Senator Coburn. But do they talk to Medicare Part D? 

Mr. Kuhn. And we are working on making sure that they can 
now talk to the DMACs. I don’t know if that system is actually put 
in place yet, but ultimately that is the goal so that the whole sys- 
tem is synched up across the way. And that is part of the reform 
effort to get at the very issues Mr. Coleman was raising. 

Senator Coburn. Mr. Chairman, I would just say Medicaid is de- 
signed to be defrauded. I mean, we have designed it. You look at 
DME. We set artificial prices. We inflated the prices based on infla- 
tion. It had nothing to do with the real cost of goods. We set it up, 
and we created the system and said here is a real lucrative area, 
let’s go take some of it. And what we really have to do is we have 
to go back and look at Medicare and change it. And I have pro- 
posed this to CMS before, if we are not going to do everything up 
front like we should be doing — which we should be holding contrac- 
tors accountable. If you were in the private sector and you did not 
have this cross-referencing available and you did not think about 
doing it beforehand, not after the fact, I mean, why wasn’t this part 
of the program 10 years ago of talking? We had a very accurate 
computer. But the answer to this is undercover patients. The fact 
is people do not like going to jail. And all you have to do is throw 
about 50 doctors in jail and about 100 DME suppliers and 100 hos- 
pice suppliers, and you know what? This fraud would go from $80 
billion a year down to about $5 billion. But nobody wants to do the 
hard work of the true undercover to get rid of the fraud. And we 
will not do the hard work of changing the system where it is not 
fraud — it is not a pro-fraud environment. 

I would like to know from Mr. Kuhn and Mr. Vito, how would 
you have us change the Medicare program so that it is not so entic- 
ing for fraud? 

Mr. Kuhn. Boy, that is a very good question. I think part of the 
issues you talked about in terms of are there better ways that we 
can do it in terms of active surveillance or areas that we are look- 
ing at. For example, one of the initiatives we launched with the 
Justice Department, the IG, and others was about 2 years ago 
called Operation Accidental Tourist, where we went through the 
Miami area looking at DME suppliers. And as a result, that re- 
sulted in a revocation of close to 500 suppliers out there that were 
nothing more than storefronts, folks that were clearly trying to de- 
fraud the program. 

There is a new Medicare task force operated by the Department 
of Justice that is having some real success, and my understanding, 
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within the last year to 18 months, is that has led to around 55 
prosecutions and convictions out there right now. 

So I think getting tougher on the fraud side of the ledger is going 
to make a big difference. But you are right at the outset. It really 
is how you pay and what you pay for. When you have mis-priced 
procedures, when you pay too much for something, as we do in 
DME and other areas, it does bring the fraudsters into the pro- 
gram. 

When you have systems that do not adequately work with one 
another and talk, as has been the subject of this hearing, it leaves 
opportunities for people to kind of encroach on the program that is 
out there. 

But I think at the end of the day, where it really makes a dif- 
ference is that we have good, legitimate suppliers out there, people 
we can count on and trust and try to drive integrity in every step 
of the process that we have there, and to make sure that the pay- 
ment systems are as fair and as honest as they can be. I think we 
have a fair payment and legitimate suppliers out there. Those are 
the areas that I think are going to give us the biggest bang for our 
buck. 

Senator Coburn. Mr. Vito. 

Mr. Vito. Well, it is very important that the controls that are es- 
tablished be utilized in the manner that is most effective. Largely, 
the program is relying on honest providers to file claims properly, 
and that is the way the system was designed. So it is a lot of trust 
that is involved in the provider billing process. But I think there 
needs to be more verification with the trust and more checks up 
front to ensure that things are done properly. 

We have worked with CMS, the Department of Justice, and oth- 
ers, for example, in South Florida, and we have really made a dent 
into the problem of the DME suppliers down there. I think it is a 
concerted effort of identifying vulnerabilities, correcting those 
vulnerabilities, making sure that they do not exist, and then engag- 
ing in collaborative activities that best utilize our investigators and 
the Department of Justice resources simultaneously. So largely 
what it is, is all of us working together to get the best results and 
by doing it with all the tools that are available to us, such as elimi- 
nating the vulnerabilities that we identify and then taking actions 
to prosecute the people who committed the crimes and make sure 
that is known by other people who would do likewise. We need to 
make sure that we continue to stay on the task until it is resolved. 

Senator Coburn. Mr. Chairman, I have one further request, and 
I don’t know if I asked you this. And I think I did, but I wanted 
to confirm it with Mr. Kuhn. The list of people who have been fil- 
ing claims for DME equipment under the pretense of a deceased 
physician and the sanctions applied, you will give that to the Sub- 
committee? 

Mr. Kuhn. You did ask for that, and we will supply that to the 
Subcommittee. 

Senator Coburn. Thank you, Mr. Chairman. 

Senator Levin. Thank you, Dr. Coburn. 

Just one thing that I want to pursue and then see if colleagues 
have any additional questions. There is supposed to be a vote any 
minute. 
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When we talked before about the deceased date information com- 
ing to the agency, what you said, Mr. Gray, is that the same infor- 
mation is going to be going under the new system as is going under 
the old system. That is not going to change. 

Mr. Gray. Let me be clear, Senator. It is the same file format. 

Senator Levin. All right. And then the question was raised: How 
often would somebody press a button, I guess, at CMS to put a hold 
on any payment to somebody, a doctor, who is deceased, a payment 
to a provider based on that identification number? And I think Dr. 
Coburn asked the question about — well, you said every month, and 
Dr. Coburn I think said why not do it every week, and you said, 
well, we could do it every week. 

Why can’t that be done automatically? Why couldn’t it be done 
when the information comes over from Social Security that some- 
body is deceased, automatically there is a hold on that file? Why 
does someone have to press a button even? Why can’t we have soft- 
ware saying it is automatic? 

Mr. Kuhn. I think there are two different issues here at play. 
One is trying to update the files to make sure that we have the 
batches that we get from Social Security in order to get the de- 
ceased physicians, and that is one issue, to make sure that our files 
are accurate. That presumably would be done on a weekly basis. 

I think the question you are asking is that when our claims sys- 
tem detects that there is a deceased 

Senator Levin. No. 

Mr. Kuhn. OK. I am sorry. 

Senator Levin. I go to the first question. Why is that not done 
automatically? Why isn’t there a hold placed automatically when 
that information comes electronically to you? 

Mr. Kuhn. Oh, well, it depends when we process the batches. 

Senator Levin. Is that electronic processing? 

Mr. Kuhn. Yes, and presumably — and again, our data folks 
would be the ones that could speak to this better. But presumably 
they have to reserve data-processing time. These probably would be 
files that would be run at night, on weekends, things like that. 

Senator Levin. It would just be inputted by hand? 

Mr. Kuhn. I do not think so. I am sure it is all electronic. 

Senator Levin. Well, then, why do we have to wait a week? Why 
isn’t it an automatic hold on that file electronically when that in- 
formation comes in? 

Mr. Kuhn. Well, I think, as you may know, Senator, there is real 
competition for computer time when you run large files like this, 
and I think it is just a matter of whenever they can schedule that. 
If we can do it even more rapidly than every week, I think that 
would be preferable. 

Senator Levin. Well, I am just wondering why it is not an auto- 
matic deal. If you could check 

Mr. Kuhn. Sure, with the data folks. 

Senator Levin. Just find out whether that could be done auto- 
matically as the information comes in, bingo, it is done electroni- 
cally as it comes in, just the way we get e-mail automatically, 
which triggers a bell in my wife’s head somewhere. 

Senator Coleman. I have nothing further now. We have a lot of 
information coming back to us, Mr. Chairman, that we will need 
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to take a look at and see whether we need to schedule another 
hearing. 

Senator Levin. We want to thank our witnesses. Again, thank 
you, Senator Coleman, and your staff for your initiative here, and 
we thank all of our staff. They work together very well, as you 
pointed out. We are grateful for that. 

We will stand adjourned. 

[Whereupon, at 11:54 a.m., the Subcommittee was adjourned.] 
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Chairman Levin, Ranking Member Coleman, thank you for the opportunity to testify 
today regarding the Subcommittee’s findings on Medicare payments for claims 
containing invalid or inactive provider identification numbers (PINs) of deceased 
physicians. The Centers for Medicare & Medicaid Services (CMS) appreciates the time 
and resources that the Subcommittee has invested in this study; we have carefully 
considered the preliminary findings shared verbally with us by Subcommittee staff, and 
we too are concerned. We look forward to an opportunity to review the complete 
findings and the Subcommittee’s report. 

With increasing expenditures, expanding Federal benefits, and a growing beneficiary 
population, the importance and the challenges of safeguarding CMS programs are greater 
than ever. Fraud, waste, and abuse schemes have become increasingly complex, and are 
quick to adapt and stump even the latest oversight strategies of Congress, CMS, and our 
law enforcement partners. With CMS’ expansive role in the U.S. health care system 
comes a tremendous responsibility to protect our programs’ integrity, promote efficient 
operations, and ensure safe and quality health care for all beneficiaries. 

Responsible and efficient stewardship of taxpayer dollars is a critical goal of this 
Administration, as evidenced by a government-wide effort to improve financial 
management by way of the President’s Management Agenda (PMA). Under the PMA, 
Federal agencies are mobilizing people, resources, and technology to identify improper 
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payments in high-risk programs; establish aggressive improvement targets; and 
implement corrective actions to meet those targets expeditiously. Consistent with these 
efforts, CMS is committed to identifying program weaknesses and vulnerabilities to help 
prevent fraud, waste, and abuse, and to improve quality of care. 

As part of a sound financial management strategy, CMS has a long history of using 
improper payment calculations as a tool to monitor the fiscal integrity of Medicare. 
Improper payment calculations help identify the amount of money that has been 
inappropriately paid; the causes of the inappropriate payments; and strategies for 
strengthening internal controls to stop improper payments from continuing. 

CMS has made great strides in significantly reducing the Medicare fee-for-service (FFS) 
error rate in recent years by educating providers about appropriate medical record 
documentation and methods to improve their accuracy and completeness. For example, 
in FY 2005, we strove for a Medicare FFS error rate of 7.9 percent and the actual error 
rate was 5.2 percent. For FY 2006, the goal was 5. 1 percent and the actual error rate was 
4.4 percent. The goal for FY 2007 was 4.3 percent and the actual error rate released in 
November 2007 was 3.9 percent, again improving upon the target. Paying claims right 
the first time ensures the proper expenditure of the Medicare trust funds and saves 
resources required to recover improper payments. 

Durable Medical Equipment Fraud 

CMS appreciates the Subcommittee’s shared interest and goal of reducing waste, fraud, 
and abuse in the Medicare program, such as the apparent, continuing inappropriate use of 
PINs at issue today. As discussed in further detail below, CMS already has taken steps to 
implement policy changes and new procedures so that invalid or inactive PINs are not 
used by unscrupulous suppliers of Durable Medical Equipment, Orthotics, Prosthetics 
and Supplies (DMEPOS) or any other unscrupulous provider to bill Medicare in the 
future. 
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As you know, the topic of fraud and abuse in the context of Medicare-covered DMEPOS 
has been a focal point of CMS program integrity initiatives in recent years. The activity 
highlighted by the Subcommittee’s recent findings is one troubling example of DMEPOS 
fraud and abuse, but in truth, the variations in this area are manifold. 

Within the last 18 months, CMS and our law enforcement partners at the Department of 
Health & Human Services Office of Inspector General (OIG), the Department of Justice, 
and the Federal Bureau of Investigation have identified and documented significant 
fraudulent activity by DMEPOS suppliers in Miami and the Los Angeles metropolitan 
areas. While both regions of the country have high numbers of Medicare beneficiaries, 
there has been a tremendous spike in the number of suppliers and utilization: the number 
of DMEPOS suppliers in these areas has almost doubled and billing from the suppliers 
remains disproportionately high. 

During FY 2006, the National Supplier Clearinghouse (NSC), the national enrollment 
contractor for DMEPOS suppliers, conducted 1,472 inspections of Miami DMEPOS 
suppliers. As of October 2006, the billing numbers of 634 DMEPOS suppliers had been 
revoked, including 143 suppliers that had been enrolled within the previous 12 months. 
This effort, which is still ongoing, resulted in a projected savings to the Medicare 
program of $3 1 7 million. The NSC spent approximately $3 million on all enrollment 
efforts in Miami, resulting in a return on investment of greater than 100:1 ($100 in 
savings for each dollar spent to conduct the project). A similar initiative was conducted 
in the Los Angeles area last year. 

The types of fraud committed by the DMEPOS suppliers in Miami and the Los Angeles 
metropolitan areas included: (1) billing for services not rendered, which involved claims 
for power wheelchairs, scooters, nutritional products (e.g., Ensure), orthotics, prosthetics, 
hospital beds, etc.; and, (2) billing for services not medically necessary. CMS and its 
contractors have identified thousands of Medicare beneficiaries living in California and 
Florida who are receiving DMEPOS items that they did not require based upon their 
medical history and/or are receiving Medicare Summary Notices (MSNs) for items that 
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are not only unnecessary, but never ordered by their physician and never received by the 
beneficiary'. CMS staff in Los Angeles and Miami have interviewed multiple physicians 
who have provided attestations that they never saw the patients for which DMEPOS was 
ordered and correspondingly never ordered the suspect DMEPOS items. 

Fraud and Abuse Activities Involving Invalid Provider Identification Numbers 

CMS shares the Subcommittee’s concern with inappropriate use of invalid or inactive 
PINs on Medicare claims. We have taken steps internally and with our claims processing 
contractors to substantially curb and ideally eliminate this practice. 

CMS processes claims and makes payments for FFS Medicare benefits through contracts 
with private companies called fiscal intermediaries (FIs), carriers, and Medicare 
Administrative Contractors (MACs). For 2008, CMS estimates that these claims 
administration contractors will process well over one billion claims from providers, 
physicians, and suppliers for items and services that Medicare covers. The contractors 
review claims submitted by providers to ensure payment is made only for Medicare- 
covered items and services that are reasonable and necessary and furnished to eligible 
individuals. 

CMS issues more than 600 instructions annually to claims administration contractors and 
the process for reviewing and implementing those instructions is well documented by the 
Agency. After a detailed review and comment process, where implementing instructions 
are fine-tuned by CMS with its contractors, claims administration contractors are required 
to certify that they have implemented each final instruction and report back to CMS on a 
quarterly basis. CMS conducts regular oversight of each Medicare claims administration 
contractor and “spot checks” the implementation of new processing instructions. In 
addition, CMS conducts formal performance evaluations on an annual basis to assess 
individual contractor compliance with Agency requirements for implementation of 
Agency directives. 
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When concerns with use of invalid or inactive physician identification numbers were first 
brought to CMS’ attention by the OIG in 2001, we concurred with their recommendations 
and took steps, working with our contractors, to ensure that identification numbers used 
on DMEPOS claims were valid and active. For example, contractors were instructed to 
research, update, correct and where necessary, deactivate PINs with invalid addresses 
and/or no claims activity for one year. In addition, the contractor responsible for 
maintaining our physician identification number registry subcontracted with the 
American Medical Association (AMA) to obtain provider data extract files containing 
physicians’ dates of death on a bi-weekly basis. On a monthly basis, CMS’ claims 
payment contractors were sent a deceased physician notification list and notified to 
update their physician records. This was intended to ensure that Medicare does not pay 
claims in both the circumstance where the physician (or other Medicare-recognized 
practitioner) is the rendering practitioner as well as where the physician or practitioner is 
the ordering or referring entity (as is usually the case with DMEPOS) and the date of the 
physician’s death precedes the date of service. Notwithstanding the completion of these 
initiatives, CMS looks forward to the opportunity to review the Subcommittee’s recent 
findings to determine what additional measures we might implement to further reduce 
improper payments of this nature. 

Beginning in October 2006, CMS initiated a systematic deactivation of PINs where there 
has been no claims activity for 12 consecutive months. If any claim is received after the 
deactivation date, the Medicare contractor would reject the claim submission and require 
the physician or supplier to update their Medicare enrollment prior to receiving payment. 
To date, CMS has deactivated approximately 1 .5 million PINs. 

Fortunately, the recent conversion to the new National Provider Identifier (NPI), along 
with further documentation and data exchange improvements, significantly strengthen 
CMS’ ability to combat fraud and abuse that rely on invalid provider identifiers. The 
Health Insurance Portability and Accountability Act of 1996 required the establishment 
of new, unique national identifiers to improve the efficiency and effectiveness of 
electronic transmission of health care administrative transactions. CMS achieved 
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compliance with this requirement on May 23, 2008, from which point all Medicare 
claims submitted by physicians and other practitioners, laboratories, ambulance suppliers, 
DMEPOS suppliers, and others who bill Medicare, are required to include only the new 
NPI in such transactions. Further, all providers and suppliers intending to bill Medicare 
are required to apply for and secure a new NPI - and to use the NPI exclusively on all 
forms, and in all electronic formats, when billing Medicare. Moreover, for all claims 
where a physician or other practitioner has ordered or referred the service or item (as in 
the case of DMEPOS), the billing entity must furnish the NPI of the ordering or referring 
physician or practitioner. Medicare program safeguard system edits, which had 
previously referenced PINs, now reference NPIs. 

The mandate to use the NPI exclusively for all provider or supplier identifications in 
Medicare billing has the added benefit of eliminating invalid or inactive legacy PINs, 
which previously might have been used for illegitimate purposes such as those 
highlighted by the Subcommittee. As a result, CMS believes the vulnerability for further 
fraud and abuse relying on provider identifiers of deceased physicians is substantially 
smaller today than before full NPI implementation. To date, CMS has assigned 
approximately two million NPIs to individual practitioners such as physicians and non- 
physician practitioners. 

Further, on January 25, 2008, CMS published in the Federal Register a proposed rule 
titled, “Medicare Program; Establishing Additional Medicare Durable Medical 
Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS) Supplier Enrollment 
Safeguards” (CMS-6036-P). CMS proposed requiring DMEPOS suppliers to maintain 
ordering and referring documentation received from a physician or other non-physician 
practitioner (e.g., nurse practitioner, physician assistant, etc.) for seven years. We believe 
that this change, if adopted, will strengthen our ability to identify fraudulent billing 
during documentation reviews. We believe that requiring DMEPOS suppliers to 
maintain documentation from the ordering physician or non-physician practitioner will 
allow CMS to expand its efforts to identify and detect DMEPOS suppliers who are 
submitting claims that are not supported by the appropriate verifiable documentation. 
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CMS currently is reviewing public comments received on the proposed rule. On June 30, 
2008, we proposed a similar requirement for physicians and non-physician practitioners 
when ordering or referring services for Medicare patients in the CY 2009 Medicare 
Physician Fee Schedule. 

In addition, CMS finalized a new information exchange agreement with the Social 
Security Administration (SSA) on July 1, 2008 which will provide CMS with monthly 
updates of the SSA’s Death Master file and unrestricted State death data beginning in 
August. CMS will then be able to match this information with information contained in 
the National Plan and Provider Enumeration System - the central system that maintains 
information about NPI - and our provider enrollment database, the Provider Enrollment, 
Chain and Ownership System. After confirming an individual practitioner is deceased, 
CMS will deactivate both the NPI and the practitioner’s enrollment in the Medicare 
program. 

Finally, while our current claims processing system allows any NPI to be used for the 
purpose of ordering and referring services to Medicare beneficiaries, we anticipate 
implementing changes in 2009 that will limit ordering and referring to individual 
practitioners enrolled in the Medicare program. 

Conclusion 

Thank you again for the opportunity to testify today. CMS appreciates the 
Subcommittee’s ongoing efforts in support of fiscal and program integrity. We believe 
the initiatives described above will address many of the issues surrounding improper 
payments for claims relying on invalid or inactive provider identification numbers. We 
are continually considering initiatives to improve program integrity within Medicare and 
look forward to continued work with the Subcommittee and our partners represented here 
today to further strengthen our stewardship of the Medicare trust funds. 
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Testimony of: 

Robert A. Vito 

Regional Inspector General for Evaluation and Inspections 
Office of Inspector General, U.S. Department of Health and Human Services 


Good morning, Mr. Chairman and Members of the Subcommittee. 1 am Robert Vito, 
Regional Inspector General for Evaluation and Inspections in Philadelphia at the U.S. 
Department of Health and Human Services’ (HHS) Office of Inspector General (OIG). 
Consistent with its statutory mandate, OIG has devoted considerable resources toward 
fighting fraud, waste, and abuse involving Medicare coverage and payment for durable 
medical equipment (DME), prosthetics, orthotics, and related supplies. OIG has 
performed evaluations, investigations, and audits on an array of DME-related issues; 
made recommendations to the Centers for Medicare & Medicaid Services (CMS) to help 
correct vulnerabilities that make the DME area so susceptible to fraud, waste, and abuse; 
and performed targeted follow-up work to ensure that corrective actions have been taken 
to eliminate or minimize these vulnerabilities. 

One issue — the Medicare requirement that a supplier include on a DME claim the unique 
physician identification number (UPIN) of the physician who ordered the DME — is the 
subject of my testimony today. OIG has found that the lack of edits or other reviews that 
validate the UPIN listed on DME claims presents a vulnerability that has allowed 
millions of dollars in questionable claims to be paid. OIG studies have uncovered: 

(1) the use of UPINs that were invalid or inactive, (2) the use of UPINs that belonged to 
physicians who had died prior to the dates of service, (3) the improper use of surrogate 
UPINs, and (4) the use of legitimate UPINs that were associated with an unusually large 
number of claims. 

It should be noted that effective May 23, 2008, CMS began requiring the use of national 
provider identifiers (NPIs) rather than UPINs on supplier claims, as mandated by the 
Health Insurance Portability and Accountability Act of 1996. However, OIG remains 
concerned that the vulnerabilities identified in our UPIN studies, as well as other NPI- 
specific challenges, may affect the integrity of the new system. 

My testimony today provides a brief overview of OIG and our work related to DME.. It 
then specifically focuses on studies involving the use of UPINs on DME claims. Finally, 
I will discuss issues to be considered by CMS now that the NPI requirement has been 
implemented, as well as OIG’s future plans to provide oversight on this important issue. 

Role and Responsibilities of HHS OIG 

HHS OIG was created in 1976 and was the first statutory OIG in the Federal 
Government. Two years later, the Inspector General Act of 1 978 (IG Act) established 
OIGs at other Cabinet-level departments of the Federal Government, as well as at some 
independent Government agencies. 
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Congress created OIGs to be independent and objective units within Federal departments 
and agencies for the purpose of: (1) conducting audits and investigations of programs 
and operations; (2) coordinating and recommending policies to promote economy, 
efficiency, and effectiveness in the administration of programs; (3) preventing and 
detecting fraud and abuse; and (4) keeping the Department Secretary or Agency 
Administrator and Congress informed about the necessity for corrective action. 

To achieve these objectives, our office reviews departmental programs to identify 
systemic vulnerabilities and makes recommendations to improve their efficiency and 
effectiveness; investigates specific instances of fraud, waste, or abuse and takes 
appropriate enforcement actions; audits specific payments, providers, and programs to 
identify and recover overpayments; and promotes voluntary compliance by issuing 
guidance to health care providers and the health care industry. 

Although the Medicare program relies on providers to submit accurate and appropriate 
claims for payment, and the vast majority of providers are honest and trustworthy, 
provider efforts alone are not sufficient to ensure the integrity of the program. OIG plays 
a key role in protecting public funds and the health and welfare of beneficiaries. Our 
effectiveness relies heavily on coordination and cooperation with our law enforcement 
partners, including the Department of Justice’s (DOJ) Civil, Criminal, and Civil Rights 
Divisions, U.S. Attorneys’ Offices, and the Federal Bureau of Investigation (FBI). As the 
administrator of Medicare, CMS is also a key partner and plays an important role in our 
efforts to protect the program and its beneficiaries. 

Our staff expertise, national presence, organizational structure, and collaboration with 
law enforcement partners enable OIG to leverage scarce resources to achieve maximum 
return for the oversight dollars invested. In the 6-month period from October 1, 2007, to 
March 3 1 , 2008, OIG conducted audits and investigations that resulted in anticipated 
recoveries of $2.2 billion; exclusions of 1,291 individuals and entities from participation 
in Federal health care programs; 293 criminal prosecutions for crimes against HHS 
programs; and 142 civil or administrative monetary recoveries pursuant to False Claims 
Act cases, unjust enrichment suits, civil money penalty cases and administrative 
recoveries related to provider self disclosure matters. For fiscal years 2004-2006, our 
average return on investment was nearly $13 for every $1 in funding. 

Each year, to help ensure that we achieve maximum effectiveness and impact, OIG 
develops a work plan to guide our activities. 1 Although resource constraints preclude us 
from annually reviewing all 300-plus programs administered by the Department, OIG 
engages in this comprehensive work-planning process to identify the most important and 
timely issues for the upcoming fiscal year and to direct our resources accordingly. 

Among the things that OIG considers in setting its work priorities are findings from 
previous OIG and external reviews, the size of the program (e.g., expenditures, number of 
beneficiaries served), specific requests for work from Congress and the Department, the 
need to revisit program areas with identified vulnerabilities, and the need to review new 
and emerging issues. 


' Available online al hltp.7/wvva .oig.hhs.gov/ t nublications»'workplan.html . 
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In addition to our work-planning process, and consistent with the requirements of the IG 
Act, OIG reports to Congress semiannually on our activities. OIG's semiannual report 
provides a 6-month summary of OIG’s completed work during the reporting period and 
covers the spectrum of OIG audit, evaluation, and enforcement accomplishments. Each 
semiannual report identifies significant recommendations described in previous 
semiannual reports for which corrective action has not been completed. Appendixes to 
each semiannual report list significant unimplemented recommendations. 

Because of the abbreviated nature of the appendixes to the semiannual reports, OIG also 
issues a “Compendium of Unimplemented Office of Inspector General 
Recommendations.” 2 This document serves as a useful tool for Congress, the 
Administration, and the Department in their respective efforts to identify ways to contain 
costs, maximize the effectiveness of programs and services, and improve the efficiency of 
departmental programs. Implementation of the recommendations in this document could 
result in substantial savings and increased effectiveness in the operation of the Medicare 
program. 


OIG Work Related to DME 

OIG work related to UPINs was undertaken within the broader context of our oversight 
efforts involving Medicare coverage and payment for DME. Because Medicare’s DME 
benefit has proven to be particularly susceptible to fraud, waste, and abuse, it has been a 
focal point of a number of OIG activities, initiatives, and recommendations. Medicare 
Part B expenditures for DME and related supplies totaled more than $1 0 billion in 2007, 
of which beneficiaries paid more than $2 billion in the form of copayments and 
deductibles. OIG evaluations, audits, and investigations have demonstrated that: 

(1) Medicare pays too much for certain DME and supplies; (2) Medicare pays for some 
DME claims that do not meet coverage requirements; and (3) a number of DME suppliers 
have been able to circumvent the existing controls and defraud the program, costing 
Medicare millions of dollars a year. I will discuss each of these in turn. 

Pricing of DME and Related Supplies 

OIG’s evaluations involving power wheelchairs, hospital beds, diabetic supplies, home 
oxygen equipment, and inhalation drugs used with nebulizers, among other items, have 
consistently found that Medicare pays too much for certain pieces of DME and related 
supplies. In many cases, we have performed additional studies on a subject in an attempt 
to ensure that our recommendations were implemented and outstanding issues were 
resolved. 

For example, OIG issued its first report on excessive Medicare payments for home 
oxygen equipment in 1987. 3 We released a second report on the issue in 1991, again 


" Available online at http:/, 'www.oig.hhs.gov/oublicalions/compcndiuin.htinl . 

3 “Medicare Reimbursement for At-Home Oxygen Care” (OAI-04-S7-00017). December 1 987. 
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finding that Medicare paid substantially more than other payers. 4 We revisited the 
subject of oxygen reimbursement in a 2005 report, which found that Medicare allowances 
for home oxygen equipment were substantially higher than the Federal Employee Health 
Benefit program rates. 5 Information from our report was used to reduce Medicare 
payment rates by an average of 8.6 percent for stationary oxygen equipment and 
8. 1 percent for portable oxygen equipment. To assess the impact of these changes, in 
December 2006, OIG released another report, which found that Medicare payment levels 
for oxygen concentrators were still several times higher than their actual cost. 6 

In addition, OIG issued eight reports between 1 996 and 2004 that focused on Medicare 
payments for inhalation drugs used with nebulizers (e.g., albuterol, ipratropium bromide) 
that are covered under the DME benefit. 7 We repeatedly found that Medicare 
reimbursement amounts for these drugs greatly exceeded other pricing points (i.e., 
Medicaid, supplier acquisition costs, and retail prices), and made numerous 
recommendations calling for Medicare payments to be lowered. These recommendations 
were implemented by the new drug reimbursement methodology established by the 
Medicare Prescription Drug, Improvement, and Modernization Act of 2003. 

DME Coverage Requirements 

OIG has also performed numerous reviews to determine whether the DME claims paid 
under Medicare conformed to coverage requirements. For example, in a 2004 evaluation, 
we sought to determine whether power wheelchair claims met Medicare’s coverage and 
documentation requirements. 8 We found that most of the reviewed claims did not meet 
Medicare’s coverage criteria for the wheelchair that was provided; however, some claims 
may have met coverage criteria for a less expensive mobility device. For over half of the 
claims we reviewed, required documentation was missing, incomplete, or dated after the 
date of service listed on the claim. We recommended that CMS improve compliance 
with Medicare’s coverage criteria for power wheelchairs and suggested several specific 
steps to help accomplish that goal. 

CMS implemented many of OIG’s recommendations through its power wheelchair 
workgroup, which was established to develop a plan of action to ensure that Medicare 
payments are only made for power wheelchairs that are reasonable and necessary. We 
recently started another study on power wheelchairs that will determine the effect of 
CMS’s actions. 

OIG has also investigated cases in which DME suppliers billed for services not rendered 
or medically unnecessary services. For example, OIG, in coordination with its partners at ' 


4 “Oxygen Concentrator Reimbursement: Medicare and the Department of Veterans Affairs” 
(00-03-91-00711). August 1991. 

“Medicare Payment Rates for Home Oxygen Equipment” (OEI-09-03-00160). March 2005. 

4 “Home Oxygen Equipment: Cost and Servicing" (OEI-09-04-00420). December 2006. 

7 For example, see “Update: Excessive Medicare Reimbursement for Albuterol” (OEI-03-03-005 1 0). 
January 2004, and “Update: Excessive Medicare Reimbursement for Ipratropium Bromide” 
(OEI-03-03-00520). January 2004. 

* “Medicare Payments for Power Wheelchairs” (OEI-03-02-00600). April 2004. 
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the Texas Medicaid Fraud Control Unit and FBI, recently completed an investigation 
involving inappropriate DME claims submitted by The Scooter Store, Inc. The 
Government alleged that the company submitted false claims to Medicare and Medicaid 
for power wheelchairs that beneficiaries did not want, did not need, or could not use; 
submitted claims for used power wheelchairs, scooters, and accessories as though the 
equipment were new; submitted claims for power wheelchair accessories that were not 
ordered by a physician; and improperly induced beneficiaries by promising free mobility 
equipment. In 2007, The Scooter Store entered into a settlement agreement with the 
Government to resolve its False Claims Act liability. The Scooter Store agreed to pay 
$4 million and relinquish its right to approximately $13 million in claims initially denied 
for payment by CMS. The Scooter Store and its individual owner also agreed to enter 
into a 5-year corporate integrity agreement. 

Controls To Ensure Appropriate DME Payment 

OIG has also focused on DME suppliers and, in some cases, ordering physicians, who 
circumvent existing controls in order to defraud the program. Many of these efforts 
addressed the three basic controls employed by Medicare to ensure that claims are 
legitimate. These three controls validate that: (1) the beneficiary is enrolled in the 
Medicare program; (2) the DME supplier meets the Medicare standards and has received 
a Medicare billing number; and (3) the DME or supplies have been ordered by a 
physician or other approved health care practitioner. I will address each of these in more 
detail below. 


OIG Work on Beneficiary and Supplier Controls 


Beneficiaries 


As part of many DME-related studies, OIG has contacted beneficiaries to gather their 
experiences with certain pieces of equipment or particular suppliers. We have also 
analyzed claims data to identify payments made to suppliers for ineligible beneficiaries. 

For example, as part of a study published in 2000, we found that Medicare paid 
$9.2 million in 1997 for DME and related supplies provided after the beneficiary was 
deceased. 9 We recommended that CMS conduct prepayment edits and postpayment 
reviews to ensure that payments are not made for these types of claims. In response, 
CMS created a prepayment edit to deny payments when the beneficiary is deceased. In 
addition, CMS instructed its contractors to conduct annual postpayment reviews to 
identify and recover payments for items and services furnished and claimed after a 
beneficiary’s date of death. 

Suppliers 

DME suppliers must enroll in the Medicare program to sell or rent items to Medicare 
beneficiaries and, in turn, submit claims to Medicare for reimbursement. Currently, 


! “Medicare Payments for Services After the Date of Death” (OE1-03-99-00200). March 2000. 
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DME suppliers must comply with 24 supplier standards to receive and maintain a 
Medicare billing number. For more than 1 0 years, OIG has reported on weaknesses in 
CMS’s oversight of DME suppliers' compliance with Medicare’s enrollment standards. 

In a 1997 report, OIG recommended that CMS conduct site visits of DME suppliers 
specifically at the time of enrollment in the Medicare program. 10 Subsequently, CMS 
incorporated initial site visits into the supplier enrollment process. In a second report 
issued in 2001, we recommended that CMS institute random, unannounced site visits of 
suppliers in addition to the initial enrollment and reenrollment visits. 1 1 In response, CMS 
stated that it would increase site visits to suppliers that did not pass inspection. 

We have recently expanded efforts to identify suppliers who were not in compliance with 
Medicare enrollment standards. In 2005, we conducted out-of-cycle site visits to 
169 DME suppliers to determine whether they met the Medicare requirements of 
maintaining a physical facility and being open to conduct business during posted hours. 12 
We found that 10 of these suppliers were not in operation at their business address, yet 
still billed Medicare almost $393,000 in the 2 months after we had determined they did 
not maintain facilities at their address of record. 

Further, based on evidence of concentrated problems with supplier enrollment in certain 
areas of the country, we conducted unannounced site visits to 1 ,581 DME suppliers in 
South Florida in late 2006. 13 We found that 31 percent of these DME suppliers did not 
maintain physical facilities or were not open and staffed during their posted business 
hours. Another 14 percent of suppliers were open and staffed but did not meet additional 
requirements we reviewed. We recommended several steps that CMS could take to 
address the concerns highlighted in these reports, including conducting random 
unannounced site visits, strengthening the provider enrollment process, and limiting the 
ability of fraudulent suppliers to obtain Medicare billing numbers. In response, CMS 
implemented a 2-year demonstration project involving the enrollment of DME suppliers 
into Medicare. 14 

In 2007, OIG expanded its review of supplier enrollment by conducting unannounced site 
visits to 905 suppliers in Los Angeles County. 15 We found that 1 3 percent of suppliers 
did not maintain a physical facility or were not open when we visited, and an additional 
9 percent did not meet additional standards we reviewed. We again recommended that 
CMS strengthen the supplier enrollment process and ensure that suppliers meet Medicare 


10 “Medical Equipment Suppliers: Assuring Legitimacy” (OEI-04-96-00240). December 1997. 

11 “Medical Equipment Suppliers: Compliance with Medicare Standards” (OEI-04-99-00670). 

August 2001 . 

12 “Medical Equipment Suppliers: Compliance With Medicare Enrollment Requirements” 
(OE1-04-05-00380). March 2007. 

13 “South Florida Suppliers' Compliance With Medicare Standards: Results From Unannounced Visits” 
(OEI-03-07-00 1 50). March 2007. 

14 Available online at 

http:/Ayww.cn)S.hhs.gov/MedicareProviderSupEnroH/downloads/DME%20Fact%20Shect,Ddf . 

15 “Los Angeles County Suppliers’ Compliance With Medicare Standards: Results from Unannounced Site 
Visits” (OEI-09-07-00550). February- 2008. 
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supplier standards. In response to our recommendations, CMS stated that, among other 
actions, it had increased the frequency of unannounced site visits, begun targeted 
background checks of suppliers in high-fraud areas, and announced a mandatory 
accreditation process for DME suppliers. 

Recent investigations by OIG, DOJ, and other law enforcement agencies have also 
identified and pursued enforcement actions against fraudulent DME suppliers. In March 
2007, OIG and DOJ formed a Medicare Fraud Strike Force composed of Federal, State, 
and local investigators to combat the fraudulent activities of medical equipment suppliers 
in South Florida through the analysis of Medicare billing data. During a 3-month period 
in 2007, 56 individuals were charged in South Florida with fraudulently billing Medicare 
more than $258 million. As of March 2008, the Strike Force had brought charges against 
120 defendants, resulting in 101 convictions. Our investigation included one case in 
which a Medicare DME company billed Medicare over $14 million (and paid more than 
$1 million) for wound care, enteral nutrition products, and wheelchairs that were neither 
prescribed nor delivered. In this case, certain claims listed two prescribing physicians 
who were deceased prior to the incorporation of the company. 

OIG Work on UPINs and Physician Controls 

OIG has conducted evaluations, audits, investigations, and additional data analysis 
focusing on the ordering physicians listed on DME claims. The Consolidated Omnibus 
Budget Reconciliation Act of 1985 required CMS to establish UPINs for all physicians 
who provide services to Medicare beneficiaries. Information on UPINs is stored in a 
national database known as the UPIN Registry. 

Prior to the recent implementation of the NPI, Medicare regulations required DME 
suppliers to provide the UPIN of the physician who ordered the equipment on the claim 
form. Medicare relies on physicians and other health care practitioners to act as 
gatekeepers to ensure that only medically necessary equipment and supplies are ordered. 
When a DME supplier puts a UPIN (or NPI) in the appropriate field on the claim form, 
the supplier is indicating that a physician has verified the need for the equipment. In 
addition, the presence of the UPIN or NPI enables CMS to determine who prescribed the 
equipment and/or supplies as part of any postpayment reviews. 

Payments for DME Claims With Invalid and Inactive UPINs 

In conducting our DME-related work, we learned that Medicare claims-processing 
systems verified only that the UPIN listed on a claim met certain format requirements. 
Computer system edits were not performed to ensure that the UPIN listed on a claim had 
been assigned or was active. To assess the impact of this vulnerability, OIG determined 
the prevalence of invalid and inactive UPINs listed on Medicare claims in 1999, and 
released a report on the issue in 2001 . 16 


16 “Medical Equipment and Supply Claims With Invalid or Inactive Physician Numbers” 
(OE1-03-01-00110). November 2001. 
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We compared the UPINs listed on Medicare DME claims in 1999 to information 
contained in the UPIN Registry. We then identified Medicare payments for claims for 
which the listed UPIN was either invalid or inactive on the date of service. An invalid 
UPIN is one that has never been assigned; an inactive UPIN has been assigned but all the 
practice settings associated with the UPIN have been deactivated. 

We found that Medicare and its beneficiaries paid $32 million for DME claims with 
invalid UPINs in 1999. One-quarter of the invalid UPINs began with a letter for which 
no UPINs had ever been issued, meaning that the UPIN could easily be identified as 
one which was never assigned. Approximately 1 00 of the invalid UPINs were each 
associated with more than $50,000 in Medicare DME payments. A single invalid UPIN 
was listed as the ordering physician by seven different suppliers on $1.1 million in paid 
Medicare DME claims. 

Furthermore, Medicare and its beneficiaries paid an additional $59 million in 1 999 for 
DME claims listing UPINs that were inactive on the date of service. Almost $8 million 
of this amount involved UPINs for physicians who were deceased prior to the dates of 
service entered on the claims. Over 30 percent of the inactive UPINs listed on the 
claims had been inactive for at least 3 years. 

Finally, we found that a small number of suppliers accounted for a significant share of 
the $91 million in Medicare payments for DME claims with invalid or inactive UPINs. 
One hundred suppliers were reimbursed for $ 1 7 million of that total. One supplier was 
responsible for $1.2 million in Medicare claims, using over 1,700 different invalid or 
inactive UPINs on medical equipment and supply claims that year. Another supplier 
had 62 percent of its Medicare reimbursement associated with one invalid UPIN. 

To address the issues identified by this report, OIG recommended that CMS: (1) revise 
claims-processing edits to ensure that UPINs listed on DME claims are valid and active 
and (2) emphasize to suppliers the importance of using accurate UPINs when 
submitting claims to Medicare. In responding to our recommendations, CMS indicated 
that it had developed instructions, system changes, and edits which would reject claims 
listing a deceased physician’s UPIN. CMS also stated that it planned to expand the 
edits to include all invalid and inactive UPINs. In November 2001 and April 2002, 

CMS issued instructions to its carriers stating that DME claims listing a deceased 
physician’s UPIN would be denied. 17 We are unaware of any further CMS action taken 
to address the presence of invalid and inactive UPINs on DME claims. Therefore, we 
continued to promote our recommendations addressing the invalid and inactive UPIN 
issue by including them through 2007 in our annual publications listing unimplemented 
OIG recommendations. 18 


17 Available online at http://www.cnis.hhs.t:ov/transmittalsAjownload£/B0173.Ddf and 
http://www.cms.hhs.eovA'ra)]smittals/downloads/B02024.Ddf 

18 “Compendium ofUnimplemented Office of Inspector General Recommendations” May 2007, page 21 . 
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Accuracy of the UPIN Registry 

To ensure effective edits that prevent payments for DME claims with invalid and 
inactive UPINs, CMS needs to maintain accurate information in the UPIN Registry. 
However, in a 1 999 report, we found that although CMS had taken steps to enhance the 
accuracy of UPIN data, some problems still persisted. 19 These problems included 
UPINs with no recent claim activity still being listed as active, inaccurate physician 
information in UPIN Registry fields, and format-related issues. Further, in 2002, we 
issued a report to CMS that noted issues with the physician addresses listed in the UPIN 
registry that we identified during a study involving Medicare mental health services. 20 

In 2003, OIG issued another report on the accuracy of CMS’s UPIN data. 21 For this 
study, we contacted providers and asked them to verify information contained in the 
UPIN database for each of their active practice settings. We also reviewed the universe 
of active UPIN registry records to identify inconsistent, missing, and questionable 
information. 

OIG found that 52 percent of providers listed in the active UPIN database had 
inaccurate information in at least one of their practice setting records. Seventeen 
percent of providers no longer billed Medicare from any of the practice settings listed 
in the active UPIN file. Of that number, 14 percent were deceased, and 26 percent 
indicated they had retired. Another 9 percent of providers could not be contacted by 
mail at the addresses listed in the UPIN Registry. 

We noted that when information housed in the UPIN Registry is unreliable, CMS’s 
ability to conduct effective oversight is jeopardized. For instance, inaccurate UPIN 
data limits CMS’s ability to identify unusual billing activity, both in the performance of 
services and the ordering of services, and also inhibits CMS from verifying that 
sanctions are correctly imposed. 

Therefore, OIG recommended that CMS: (1 ) correct inaccurate and incomplete 
information in the UPIN Registry and deactivate practice settings that have never been 
or are no longer used by Medicare providers; (2) review data contained in the UPIN 
Registry to ensure that they are complete, accurate, and consistent; (3) conduct a review 
of providers who billed Medicare for Part B services in 2000 but could not be contacted 
by mail; and (4) review and revise existing UPIN Registry data entry guidelines. CMS 
concurred with our recommendations and indicated that it was taking steps to correct 
the issues. 


15 “Accuracy of Unique Physician Identification Number Data” (OE1-07-98-00410). October 1999. 

30 “Inaccuracies in the Unique Physician Identification Number Registry: Incorrect Addresses for Mental 
Health Service Providers” (OEI-03-99-00I31). May 2002. 

31 “Accuracy of Unique Physician/Practitioner Identification Number Registry Data” (00-03-0 1-00380). 
May 2002. 
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Use of Surrogate UPINs 


In 2002, OIG issued a report examining the use of surrogate UPINs on DME claims. 22 
Under Medicare guidelines, surrogate UPINs are temporary UPINs that may be used 
until an individual UPIN has been assigned. If the ordering physician for a DME item 
does not have a permanent UPIN, the supplier must use a surrogate UPIN when 
submitting the claim. At the time of our review, CMS had established four specific 
surrogate UPINs, as well as guidelines for their use. 

We selected a sample of DME claims from 1999 that listed surrogate UPINs. We 
found that 61 percent of reviewed claims should have listed a permanent UPIN rather 
than a surrogate, because the ordering physician had a permanent UPIN at the time the 
service was provided. Furthermore, nearly half of the DME ordered with a surrogate 
UPIN (45 percent) had either: (1) no written order or certificate of medical necessity to 
support the service or (2) a written order or certificate of medical necessity with one or 
more items missing. Medicare paid an estimated $61 million for these services that 
year. 

We noted that the use of surrogate UPINs on medical equipment claims enables them to 
be processed automatically whether the equipment has been ordered by a physician or 
not. If the inappropriate use of surrogate UPINs by suppliers goes unchecked, the 
Medicare program becomes vulnerable to fraudulent billings and inappropriate 
payments. Therefore, OIG recommended that CMS: ( 1 ) perform targeted reviews of 
claims for DME ordered with surrogate UPINs and (2) continue to educate suppliers 
and physicians that accurate UPINs must be used on claims. CMS concurred with 
OIG’s recommendations. 

Additional Work on UPINs 


OIG has also identified numerous UPINs that were used to order unusually high dollar 
amounts of DME. For example, in 2006, through the coordinated effort of OIG, DOJ, 
and others, a South Florida physician pleaded guilty to violating the anti-kickback and 
false claims statutes. According to the press release issued by the U.S. Attorney’s 
Office for the Southern District of Florida, 

Beginning in approximately April 1 999, [the physician] established 
referral relationships with the owners of numerous medical equipment 
companies. The owners would bring “patients” to [the physician’s] office 
and specify which types of equipment and medications they wanted her to 
prescribe. Defendant would conduct a cursory examination of the patients 


‘ “Durable Medical Equipment Ordered with Surrogate Physician Identification Numbers” (OEI-03-01- 
00270). September 2002. 
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and then sign the requested prescriptions, regardless of whether they were 
medically necessary. 23 

The UPFN belonging to this physician was used on almost $8 million in DME claims in 
1 999. This dollar amount equates to the physician ordering more than $20,000 in DME 
each day of the year. 

In other cases, it is likely that the physician did not know his or her UPIN was being 
used to order the DME. Our audits of DME suppliers identified several situations in 
which the physicians whose UPINs were listed on Medicare claims said that they had 
not ordered the equipment or supplies. In most cases, the physicians had no medical 
records for these beneficiaries, and/or stated that the beneficiaries were not their 
patients. The suppliers identified in these audits were then forwarded to OlG’s Office 
of Investigations for further review. 

More recently, we have identified additional UPINs that are associated with 
questionable billing levels in South Florida for inhalation drugs used with DME. 
According to CMS, its local Miami office has begun to actively monitor UPIN usage 
and is now working with the physicians, most of whom did not know about the billings, 
to limit fraudulent claims. 

These cases illustrate that using UPINs (or NPIs) as a control to prevent fraud is more 
complicated than simply performing edits to ensure that the identifier is valid and 
active. Because UPINs and NPIs are readily available to the public, fraudulent 
suppliers can easily obtain a valid number from their geographic area and use that 
number on their DME claims. 


National Provider Identifier 

The Health Insurance Portability and Accountability Act of 1 996 requires issuance of an 
NPI to each physician, supplier, and other provider of health care. To comply with this 
requirement, CMS began to accept applications for NPIs on May 23, 2005. Beginning 
May 23, 2008, the NPI must be used in lieu of legacy provider identifiers, such as 
supplier numbers and UPINs. 

To determine whether CMS addressed the problems identified with invalid and inactive 
UPINs in the months directly prior to the full implementation of the NPI, we are in the 
process of analyzing DME claims from 2007. Based on our preliminary analysis and 
discussions with CMS staff, we have found evidence that issues with invalid and inactive 
UPINs still existed in 2007, and may be a continuing problem with the NPI. According 
to CMS documents, edits will be established to verily that the NPI is in the correct 
format. 24 However, it is unclear whether there will be any edits to identify NPIs that 
have not been assigned or that correspond to inactive physicians. 


23 Available online at httn://149.10I.1.32/u.sao/fls/PressKeleases/060825-03.html . 

24 Available online at http://vvww.cms.hhs.eov/MLNMaitersArticles/downloads/MM4320.Ddf . 
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Furthermore, according to a CMS communication published on its Web site and dated 
June 2, 2008, CMS is temporarily allowing DME suppliers to use their own NPIs rather 
than the NPIs of the ordering physicians: 

To assist those billing providers, which, after reasonable effort, are still 
unable to obtain NPIs for secondary providers, Medicare has instituted a 
temporary measure that allows billing providers to use their own NPI in 
secondary identifier fields. 25 

The communication does not indicate the date when this policy will be discontinued. 
However, as long as DME suppliers are allowed to enter their own NPIs rather than the 
NPIs of the ordering physicians, a major control for preventing fraud, waste, and abuse 
will not exist. 

Because of our concerns with various aspects of the NPI, OIG is planning additional 
studies on the subject. Therefore, we expect to conduct several evaluations on the NPI 
during fiscal year 2009. 


Conclusion 

OIG has devoted considerable resources to identifying fraud, waste, and abuse involving 
DME claims. From large-scale reviews involving supplier site visits to data analysis 
involving the UPINs listed on DME claims, OIG has worked to safeguard taxpayer 
dollars and protect Medicare and its beneficiaries. OIG will continue to focus its 
attention on the integrity of Medicare payments for DME, make recommendations to 
resolve potential vulnerabilities, and conduct targeted follow-up work as warranted. 

One of the best ways to combat fraud, waste, and abuse is to ensure that the safeguards 
put in place to protect the program are operating effectively. One such safeguard, the 
requirement that an identifier for the physician ordering the equipment be listed on the 
claim, can be bolstered through the appropriate use of prepayment edits. However, 
despite our earlier recommendations, CMS never implemented edits that would ensure 
that the UPINs listed on DME claims were valid and active. As a result, we remain 
concerned that the vulnerabilities highlighted by our earlier work, as well as new 
challenges, may affect the integrity of the NPI system. 

Unfortunately, edits like those we previously recommended will not completely prevent 
fraud, waste, and abuse. As our work has shown, some suppliers will use valid identifiers 
(often without the physicians’ knowledge) when submitting their claims. In those cases, 
CMS must work to identify cases when there are spikes in the use of a particular NPI, 
when the NPI is consistently associated with an aberrant number of claims, or when the 
NPI used on claims is not in the geographic vicinity of the beneficiary. These 
postpayment reviews would require not only data analysis, but also outreach to the 
physicians whose NPIs are being abused. To that end, OIG is available to assist CMS in 


’ 5 Available online at littD://www.cms.hhs.gov/NalionalProvldentStand/02 WhatsNew.asn . 
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monitoring the use of NPIs on DME claims as well as developing effective methods for 
increasing the awareness of NPl-related issues among the supplier and physician 
community. 

This concludes my statement. Thank you for the opportunity to testify today. I would be 
pleased to answer your questions. 
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Statement of Bill Gray, Deputy Commissioner of Systems 
Social Security Administration 

Testimony before 

the Permanent Subcommittee on Investigations of the 
Senate Committee on Homeland Security and Governmental Affairs 

on 

Medicare Payments for Claims with Identification Numbers of 
Dead Doctors 

July 9, 2008 

Chairman Levin and Members of the Subcommittee: 

Thank you for inviting me to appear before you today to discuss the Social 
Security Administration's (SSA) collection, maintenance, and distribution of 
death information. You have asked us to address two questions: 1)How 
can we provide death records information regarding medical providers on a 
timely and regular basis to the Centers for Medicare and Medicaid 
Services (CMS); and, 2) What, if anything, do we need to facilitate the 
sharing of death records information with CMS? 

However, before I explain what, how, and when we provide death 
information to CMS, I would like to briefly describe who we are and what 
we do. 

Mission and Work of SSA 


We administer the Nation’s social insurance program and one of the 
Nation’s largest means-tested income maintenance programs. Each year 
we send benefits totaling about $650 billion to almost 60 million individuals. 

Through the Old-Age, Survivors, and Disability Insurance program, we 
provide benefits to workers and their dependents and survivors at critical 
junctures in their lives: when they retire, when they become disabled, and 
when the family’s wage-earner dies. 

We also administer the Supplemental Security Income (SSI) program, 
which assists the most vulnerable in our society. These payments are a 
safety net for those persons with little or no income or resources. The 
elderly, the blind, and the disabled, including children, rely upon SSI to 
meet their basic needs. 
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In addition, we have a number of other responsibilities that are vitally 
important to the Nation, but are not directly connected to our core mission, 
including many workloads for other agencies' programs, such as Medicare, 
Medicaid, E-Verify, Black Lung, Railroad Retirement, and Food Stamps. 
We participate in many data exchanges, including transmission of death 
information, with other Federal and State agencies as allowed by law. We 
recognize that providing this data is useful and important; however, 
performing these additional services directly affects our ability to carry out 
our core mission and responsibilities to the American people. 

Death Information Collection 


Now, I would like to provide background information on the death 
information that we collect and maintain in our records. We use death 
information to determine continuing eligibility for benefits, as a lead to 
develop possible entitlement to benefits, and for other program and 
integrity purposes. 

We receive approximately 2.5 million death reports each year from many 
sources. We receive 90 percent of the reports from family members and 
funeral homes, with the remainder coming from States and other Federal 
agencies through data exchanges and reports from postal authorities and 
financial institutions. Almost 90 percent of deaths are reported and posted 
to our records within 30 days of death. We match these death reports 
against our payment records to stop the benefits of those who are 
deceased and as a lead to develop possible entitlement to benefits for 
surviving family members. We annotate the reported death on our master 
Social Security and SSI payment records for beneficiaries. We also enter 
the information on the Social Security Number (SSN) record file, known as 
the NUMIDENT, for both beneficiaries and non-beneficiaries. 

Because of the proven accuracy of reports from family members and 
funeral homes, we do not have to verify these reports, but take immediate 
action to terminate benefits. However, in most instances, we verify all 
other reports, such as those reports received from financial institutions, 
postal authorities and other data exchanges, before we post beneficiaries’ 
deaths to our payment records and terminate their benefits. We verify 
death reports by contacting another source— -usually someone in the 
beneficiary’s home, a representative payee, a nursing home, a doctor, or 
hospital — to confirm that the person is deceased and, if the date of death is 
an issue, to corroborate the reported date of death. 
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We do not verify death reports of persons not receiving Social Security or 
SSI; however, we do annotate the death information on our NUMIDENT. It 
would be difficult for us to verify these records since we do not have 
address or other identifying information for these individuals in our records. 

The death data that we maintain is 99.5 percent accurate overall. As with 
any process, there are occasional errors, but to the best of our knowledge, 
no case of fraud or abuse has occurred as a result of errors in the Death 
Master File. 

Electronic Death Registration 

We are working with States who want, and are able, to build a streamlined 
death registration process, known as Electronic Death Registration (EDR). 
The EDR will replace the States' more cumbersome and labor-intensive 
process through which we currently receive death information. This 
streamlined electronic process allows States to transmit to us more 
accurate and timely death reports. Through this system, we receive 
verified death reports within 5 days of the individual’s death and within 24 
hours after the State receives it. We can take immediate action to 
terminate benefits on these cases. EDR transactions are virtually error 
free, and our systems automatically stop benefits without employee 
intervention. 

EDR has slowly expanded on a state-by-state basis over the past 
4 years, and currently 22 States, the City of New York, and the District of 
Columbia participate in this initiative. If all States participated in EDR, 
future death reporting would be virtually error free. The Nationwide roll-out 
of EDR is contingent on congressional funding of the Department of Health 
and Human Services so that it can fund the state grants. 

Death Master File (DMF) 


In addition to annotating an individual’s death on our records, we also 
maintain a national file of death information, known as the Death Master 
File or DMF. This file is an extract of the death information from our 
NUMIDENT. 

We create different versions of the DMF because the States have the 
authority to limit SSA’s redisclosure of their death records. Twenty-seven 
States, the District of Columbia, and the City of New York restrict 
redisclosure of their death data. However, once we verify death reports 
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received from the States, the State data then becomes our data, and we 
can redisclose it regardless of the originating State’s redisclosure policy. 

As of June 2008, the full DMF, which includes the public death data as well 
as the restricted and unrestricted State death data, contained 
approximately 85.6 million records. The full DMF includes both the verified 
and unverified reports of death for Social Security beneficiaries and non- 
beneficiaries. If available in our records, the DMF contains the deceased 
individual’s SSN, first name, middle name, surname, date of death, date of 
birth, state, county, and zip code of the last address on our records. 

Many Federal agencies, State and local governments, and the private 
sector use the DMF to prevent fraud, waste, and abuse. Some entities 
may have access to only the public death data, whereas others may have 
access to all death data, including the restricted and unrestricted State 
death data. Generally, we are reimbursed for the cost of providing this 
information. 

As I noted, our death data is over 99.5 percent accurate. While there are 
occasional errors, we are not aware of any cases of fraud or abuse that 
have occurred as a result of errors in the DMF. We will continue to release 
the DMF to facilitate private and public organizations’ ability to prevent 
fraud, abuse, and billions of dollars in erroneous payments. 

Death Information in SSA Electronic Data Exchanges 

In addition to the DMF, we have an electronic data exchange, known as 
the State Verification and Exchange System (SVES), with all States and a 
large number of Federal agencies, including CMS. The SVES is an 
overnight batch query process that matches against our NUMIDENT and 
beneficiary records. Using the SVES, requesters may ensure, among 
other things, that Federal benefits are not paid to deceased individuals. 

We also offer an online version of SVES, known as State On-Line Query 
(SOLQ). SOLQ allows authorized agencies real-time access to the SSN 
verification service and, if permitted, access to certain beneficiary data. 

While SVES is a batch system that processes multiple requests overnight, 
SOLQ is a direct query process that allows an authorized user to submit an 
individual request and provides an immediate response to the user. 
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Sharing SSA Death Data with CMS 


Now that I have explained how SSA collects and uses death information 
and the ways in which SSA shares death information with other entities, I 
would like to summarize the three different methods we use for sharing 
death information with CMS: 

• We provide the “public version” of the DMF to CMS via a direct 
electronic connection. As noted above, this version includes SSA 
death data, but does not include any State death data. We first 
provided this version to CMS in its entirety in 2001, and we now 
provide weekly updates. In total, this version currently contains 
approximately 82.4 million records. 

• CMS uses our SVES. We have provided this access on a daily 
basis since 2000. Through SVES, we provide CMS not only the 
information contained in the “public" DMF, but also the unrestricted 
State death data, which includes the date of death, and an indicator 
for restricted State death data. This means that CMS has access to 
all 85.6 million death records. Annually, we respond to 
approximately 2 million requests from CMS through SVES. 

• CMS also has access to our SOLQ. We have provided this access 
on a daily basis since the early 2000s. Through SOLQ, we currently 
provide real-time online access to the same information and number 
of death records as provided under SVES. Annually, we respond to 
approximately 1.1 million requests from CMS through SOLQ. 

You have also asked what we might need to facilitate the sharing of our 
death records with CMS. As I have described, we have the authority to 
provide CMS with the information it needs in a timely way. And, as I also 
mentioned earlier, generally, SSA must be reimbursed for the expense we 
incur in sharing death data. In addition, the efficiency and accuracy of 
death data we are able to provide would be improved if every State had 
the necessary funding to implement the EDR initiative. 

Conclusion 


Thank you for the opportunity to discuss how we collect and distribute 
death information for our own and other programs’ purposes. This data is 
vital to maintaining and assuring the integrity of Federal programs and 
protecting taxpayer funds. We have described how we assist these efforts 
to combat fraud against the people of the United States. As with our 
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existing data sharing agreements, we would require reimbursement to SSA 
for these workloads. That said, we are certainly willing to work with this 
Subcommittee and to keep working with CMS to make sure that it 
continues to be provided accurate and timely death information. 

I will be glad to answer any questions. 
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Follow-Up to the July 9, 2008 Hearing 

“Medicare Payments for Claims with Identification Numbers of Dead Doctors” 
Before the Senate Homeland Security and Governmental Affairs Committee 
Permanent Subcommittee on Investigations 

August 19, 2008 

Thank you for giving the Centers for Medicare & Medicaid Services (CMS) the opportunity to 
testify before the Homeland Security and Governmental Affairs Permanent Subcommittee on 
Investigations regarding “Medicare Payments for Claims with Identification Numbers of Dead 
Doctors” on July 9, 2008. 

With increasing expenditures, expanding Federal benefits, and a growing beneficiary population, 
the importance and the challenges of safeguarding CMS programs are greater than ever. We are 
continually considering initiatives to improve program integrity within Medicare and look 
forward to continued work with the Subcommittee to further strengthen our stewardship of the 
Medicare trust funds. With that in mind, as follow-up to the hearing, we are providing below 
additional information regarding (1) Medicare claims processing and fee-for-service (FFS) 
administrative contracting; as well as (2) CMS efforts to combating fraud and reduce improper 
payments in Medicare. 


I. Medicare Claims Processing and Contracting 

Claims Processing 

CMS is among the most efficient FFS health insurance administrators. Through Medicare FFS 
claims administration contractors, CMS processes and pays over 1.1 billion Medicare claims a 
year at a cost of less than a dollar per claim. In addition, over 99 percent of CMS claims are paid 
within 30 days, well above the legislatively-mandated standard of 95 percent. The Medicare FFS 
error rate is under 4 percent. The volume and unit costs from 2000-2007 are as follows: 


Claims 

Volumes (in 
millions) 

FY 2000 

Actual 

FY 2001 

Actual 

FY 2002 

Actual 

Part A 

150.8 

158.6 

166.9 

Part B 

740.2 

772.0 

836.7 

Unit Costs 

Part A 

0.86 

0.86 

0.86 

Part B 

0.63 

0.61 

0.60 


FY 2003 

FY 2004 

FY 2005 

FY 2006 

FY 2007 

Actual 

Actual 

Actual 

Actual 

Actual 

170.6 

179.2 

185.6 

185.9 

185.7 

881.9 

949.7 

979.9 

991.5 

959.4 

1145.1 

0.90 

0.93 

0.96 

0.96 

0.93 

0.61 

0.63 

0.64 

0.64 

0.51 


The recent Subcommittee analysis focused on claims for Durable Medical Equipment, 
Prosthetics, Orthotics, and Supplies (DMEPOS). These claims are reimbursed under Medicare 
Part B, and typically account for about 5-6 percent of the annual Part B claims volume. CMS is 
eager to review the Subcommittee’s analysis and results to respond more directly to the 
Subcommittee’s findings, though we have not yet received this information. 
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Medicare Contracting Reform 

CMS has long sought additional contracting authorities to help improve performance 
accountability in our claims administration contractors. The original 1965 Medicare legislation 
placed limitations on the types of entities who could perform Medicare claims administration 
activities, which Congress amended through the enactment of Section 91 1 of the Medicare 
Prescription Drug, Improvement, and Modernization Act of 2003 (MMA), which began to be 
utilized in Medicare contracting in 2006. Once fully implemented, the provisions in this section 
of the MMA will bring these critical Medicare claims processing contracts into alignment with 
provisions in the Federal Acquisition Regulations (FAR) that guide federal contracting practices 
related to full and open competition and performance management. 

Medicare Contracting Reform (Section 91 1 of the MMA) allows CMS to utilize fall and open 
competition to select claims administration contractors, as well as provide the opportunity for 
successful and high-performing contractors to earn a modest profit. Competition helps ensure 
that the Government is getting the best value in its contracting, balancing price and performance. 
Congress ensured that the competitive spirit would remain as an incentive for companies to 
perform well at a good price by requiring CMS to compete the FFS contracts every five years. 
The profit these contractors, known as Medicare Administrative Contractors (MACs), can earn is 
negotiated and divided between a base fee (profit awarded for meeting contract requirements) 
and award fee (profit that is earned, based on criteria for excellent performance and innovation). 

CMS is in the midst of implementing contracting reform. CMS awarded and implemented the 
first of the new contracts during 2006. At present, CMS has awarded about one-half of its 
Medicare FFS workload to MACs and expects to award the remainder to MACs by the end of 
2008; following a transition period, the new contracts will be fully implemented before the end 
of 2010. 

Contractor Accountability 

There are many ways CMS holds its claims administration contractors - carriers and fiscal 
intermediaries (contractors under the old contracting authority) as well as MACs - accountable 
for performance, including accurate claim payments. Carriers and fiscal intermediaries are 
reviewed annually by CMS through the application of a variety of evaluation protocols, 
including onsite visits and evaluations, SAS-70 reviews, and OMB Circular A- 123 reviews. In 
addition, claims administration contractors are scored under the Contractor Error Rate Testing 
(CERT) program, wherein claims are sampled by an independent entity which assesses the 
accuracy of the payment through reviews of medical documentation. Additional performance 
monitoring occurs throughout the year by agency staff. When necessary, CMS can require that 
the contractor submit a corrective action plan (CAP) for any areas where their performance has 
been lacking, and subsequently, CMS monitors the contractors’ adherence to and success of the 
CAP. CMS issues an annua! Report of Contractor Performance for all contractors, which CMS 
uses as a critical record of past performance that is taken into consideration when CMS selects 
winning bidders for new MAC contracts. 

Prior to mid-2006, the DME Regional Carriers (DMERCs) processed and paid all DMEPOS 
claims. However, CMS chose to compete DMEPOS claims administration contracts as the first 
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under the new contracting authority contained in MMA Section 911, ultimately awarding four 
new DME MACs that are now fully operational. As mentioned above, the MMA gave CMS 
additional ways to hold MACs accountable and provide incentives for good performance, 
including: 

o CMS requires all MACs to create a Quality Control Plan, which documents the 

contractor’s processes to ensure not only that they implement “quality processes,” but 
also monitor themselves to ensure they are meeting contract requirements. CMS 
approves this individualized Plan and conducts onsite audits at the MACs to ensure they 
are adhering to their approved Plan. 

o CMS evaluates key performance requirements annually for every MAC. Many of these 
evaluations occur onsite. 

o CMS manages a rigorous award fee plan program, rewarding contractors for exceeding 
contract requirements. For implemented MAC contracts, CMS has seen marked 
improvement in criteria from one award fee period to another, demonstrating that the 
award fee plan program is an effective way to focus contractors on excellence. 

o CMS and HHS, working with the Office of Management and Budget (OMB), are piloting 
the use of the Medicare claims payment error rate as one key determinant of the award 
fee for which a contractor may qualify. This metric is currently in the A/B MAC 
Jurisdiction 3 award fee plan, covering the states of North Dakota, South Dakota, Utah, 
Arizona, Montana and Wyoming, and providing increasing rewards for lower and lower 
scored error rates. The first evaluation and potential award will occur with the official 
November 2008 error rate report. 

CMS is committed not only to ensuring acceptable contract performance, but providing 
incentives for superior performance from our contractors. 

Contract Types and Authorities 

Before CMS began implementing Medicare Contracting Reform in the middle of 2006, special 
provisions in Title XVIII of the Social Security Act governed CMS contracting with Medicare 
FFS claims administration contractors. All of the contracts were “pure” cost-reimbursement 
contracts, meaning that contractors were reimbursed only for their costs of performing work on 
the government’s behalf; the contractors did not earn profit or bonuses. These contractors 
include carriers, fiscal intermediaries, and DMERCs. Since CMS is in the midst of fully 
implementing Contracting Reform, some of these contractors still provide some claims 
processing services under the old cost-reimbursement structure. 

Accordingly, to the extent that the apparent mis-payments of concern to the Subcommittee in this 
recent investigation occurred prior to mid-2006, the DMERCs that processed these claims were 
under the old contracting authority and received no profit margin for their claims processing 
work. 

Under Medicare Contracting Reform, CMS is now able to award contracts governed by FAR. 
With careful examination of the type of work and the circumstances under which it is performed 
(e.g., operating in an ever-changing environment, with quick implementations brought about by 
legislative changes in the structure and provisions of the Medicare benefit), CMS’ contracting 
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office has determined that the appropriate MAC contract type under the FAR is Cost-Plus- 
Award-Fee. This type of contract also reimburses the contractor for all costs, but allows the 
contractor to earn a small profit (generally no more than 5 percent of the value of the contract). 
Further, some of this profit can only be earned for exceptional performance, based on criteria 
CMS establishes. CMS fully intends to consider contractor payment errors in making contractor 
award fee determinations. 

Performance Penalties 

The Subcommittee has asked whether CMS would recover penalties (or the cost of the 
overpayment) from contractors who pay fraudulent claims associated with dead physicians. The 
Subcommittee has also asked whether CMS’s future contracts will deny payment to contractors 
who process claims associated with deceased physicians. 

The Medicare claims processing environment is very complex because the health care delivery 
system is very complex. As an example, all claims or even a majority of claims involving 
services referred or ordered by deceased physicians are not automatically invalid - there are 
many legitimate scenarios whereby a claim could show a deceased physician’s number in the 
ordering or referring field for a period of time (see Technical Note Section below). Given that 
the Medicare claims processing environment is so complex, from the inception of the program 
and continuing even into the new MAC contracting environment, the Congress has determined 
that Medicare claims processing contractors cannot be held liable for individual claims 
processing errors. Under the former contracting authority that was in place prior to enactment of 
the MMA, some federal courts even held that Medicare contractors had statutory immunity for 
their claims processing activities. Post-MMA, in accordance with Section 1 874A (d) of the 
Social Security Act, the MACs cannot be held liable for their claims processing activities unless 
their payment conduct meets the legal standard for “reckless disregard” or fraud. While very few 
situations meet this test, CMS pursues overpayment recoveries from the provider or DMEPOS 
supplier involved when appropriate. 

As mentioned above, current Contracting Reform initiatives allow CMS to establish performance 
standards for accurate claims payment based on achieving Government Performance and Results 
Act goals established for the CERT program, and CMS is beginning to provide parts of eligible 
payments to contractors (award fee) for superior error rate achievement. 

CMS is also able to ensure poor performers are held accountable: not only does MMA Section 
91 1 require that CMS re-compete claims processing contracts every five years, CMS may non- 
renew any contract year to year. This means that every contractor must ensure it remains the 
best value to the government (good performance, lowest cost) or it will lose its business with 
Medicare. 

Technical Notes 

As mentioned above, CMS is eager to review the Subcommittee’s analysis and results in detail 
regarding the asserted inappropriate DMEPOS claims payments. Payment for equipment that 
was ordered by a legitimate, living physician for a Medicare beneficiary would likely be 
appropriate, even if the physician died before the equipment was delivered or before the 
equipment is no longer needed. In the Medicare program, many types of DMEPOS are paid 
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through monthly rental payments. Rental payments, payments for maintenance, service, and 
repair of equipment may occur for many months after the initial order. Even if a physician died 
after ordering this equipment, in many cases it would continue to be appropriate for Medicare to 
pay for claims related to the approved item for the beneficiary. 

It should also be noted that this issue - that a physician dies shortly after making a referral or 
ordering a laboratory service - could apply to many different types of ordered Medicare services 
- not just DMEPOS -without automatically invalidating the underlying claims. Approximately 
10 percent of Americans die between the ages of 30 and 60, which is the age range for most 
practicing physicians. As the physician community numbers several hundred thousand, 
presumably it would not be uncommon for physicians to make valid referrals or issue valid 
prescriptions shortly before an unanticipated death. 

The Medicare claims processing contractors, including the contractors that process DMEPOS 
claims, utilize standard systems furnished by CMS. These systems include robust claims editing 
capabilities, but of course, the systems do not and cannot address all potential claims processing 
situations. Moreover, the proper computer systems edits cannot be stronger or more effective 
than the program databases against which they edit. In regard to the Subcommittee’s issue, at 
this time CMS provides data to the contractors on deceased physicians based on a file received 
from the American Medical Association (AMA), although that process will change with the new 
inter-agency agreement that CMS has entered into with the Social Security Administration. As 
is the case with all files, the data on deceased physicians is not automatically captured on a real- 
time basis. Clearly, CMS cannot hold contractors accountable in situations where the 
contractor’s activities were constrained by the capabilities of CMS’s systems or limitations in the 
AMA data that are passed through to them by CMS. CMS desires to conduct an analysis of 
whether any of these issues played a role in the apparent mis-payments identified by the 
Subcommittee, so that the true level of contractor-sourced errors may be determined. In order to 
do so, CMS has requested the Subcommittee’s underlying analysis and results regarding the 
asserted inappropriate DMEPOS payments. 

Provider & Supplier Accountability 

The Subcommittee (in particular, Senator Cobum) asked for information about sanctions 
imposed on providers and suppliers who submitted claims to CMS associated with dead 
physician NPI or UPIN identifiers. As noted previously, CMS is eager to review the 
Subcommittee’s analysis and results in detail regarding the asserted inappropriate DMEPOS 
claims payments. Payment for equipment that was ordered by a legitimate, living physician may 
continue to be appropriate, even if the physician died before the equipment was delivered to the 
Medicare beneficiary or before the equipment is no longer needed by the Medicare beneficiary. 

CMS has not specifically focused on the underlying reasons why suppliers or physicians may 
have been sanctioned and will need more information on specific claims that the Subcommittee 
considered in order to respond to this particular question. However, the following information is 
available on suppliers and physicians whose participation in the Medicare program has ended in 
recent years. 
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Deactivations 

Revocations 

FY 2003 

18,067 

585 

FY 2004 

16,071 

1,403 

FY 2005 

12,989 

711 

FY 2006 

12,292 

1,037 

FY 2007 

17,623 

1,297 

FY 2008 

11,614 

1,259 (thru May 2008) 


CMS shares the Subcommittee’s interest in establishing a payment environment that stops fraud 
before it occurs, however, it is a challenge to “put an automatic hold on claims with fraudulent 
data,” as suggested by Subcommittee members, because in many cases there is no way of 
knowing that the data a provider submits is fraudulent. CMS contractors use system edits that 
are programmed to catch potential claim submission errors and fraudulent activities, but these 
systems are not foolproof. However, other edits in place have accounted for a significant savings 
to the Medicare Trust Funds, (see below) 
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II. Combating Fraud and Reducing Improper Payments in Medicare 

CMS Efforts to Combat Fraud and Related Convictions 

As we carry out our obligations, we have undertaken several effective efforts to combat waste, 
fraud and abuse in this $430 billion program. Our efforts have saved Medicare - and the 
American taxpayers - more than $22 billion in just the last two years. CMS, the Agency within 
HHS that is the department’s first line of defense against Medicare abuse, has implemented a 
number of programs over the past 3 years that have achieved remarkable success. For example 
we: 

• Decreased the number of fraudulent DME suppliers by 50 percent over the past year, 
with over 1,000 of the revocations occurring in fraud hot spots of South Florida and Los 
Angeles. 

• Implemented a new overpayment recovery program, which during a three state pilot over 
the past three years returned nearly $1 billion to the Medicare program. 

• Worked with local authorities in California to indict 12 fraudulent Medicare providers 
who were also state tax cheats with returns to the state and Medicare program of over $20 
million. There are an addition 50 providers identified as part of this program and the 
projected savings are in excess of $100 million. This program was so successful that 
other local jurisdictions are partnering with Medicare to root out these wrong-doers. 

• In high risk areas like Florida, where steps have been taken to control fraudulent infusion 
therapy activities, corrective actions have resulted in denial of fraudulent and medically 
unnecessary Medicare infusion claims in excess of $1 .8 billion in 2005 and 2006. 

• Working with local authorities, we shut down a particularly abuse Medicare Advantage 
plan, which was providing clinically insufficient services and defrauding Medicare. 

• Collaborative efforts between the Miami Field Office and CMS’ program safeguard 
contractor to put in place auto-denials for preferred providers for claims submitted by 
specific DME suppliers or high ordering physicians have resulted in year to date savings 
of nearly $120 million thus far in 2008. 

• Data analysis by a CMS program safeguard contractor helped identify aberrant billing by 
an Oklahoma provider and resulted in that provider being indicted by a federal grand jury 
on 51 counts of illegally dispensing controlled dangerous prescription drugs, one count of 
health care fraud and one count of falsifying patient records. The indictment alleges that 
the provider, during 2006 and 2007, illegally dispensed more than 4,500 tablets, 
including narcotics, stimulants and tranquilizers, "outside the usual course of his medical 
practice and without legitimate medical purposes" to four individuals, one of whom was 
an undercover investigator with the Oklahoma State Board of Medical Licensure. 

• A joint initiative between the Los Angeles Field Office and CMS’ program safeguard 
contractor has resulted in 850 investigations pertaining to suspected fraud involving 
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DME suppliers in Southern California which have resulted in administration actions such 
as revocations, suspensions, overpayments or pre-payment edit. Others have been 
referred to law enforcement for potential prosecution as part of the law enforcement 
strike force formed in March 2008. These cases consist of suspected blatant fraud, and 
dollar losses to the Medicare program exceeded $500 million. The aggressive 
administrative actions taken as a result of this initiative have resulted in savings to the 
Medicare program in excess of $1 billion. 


• CMS is working collaboratively with the U.S. Department of Health & Human Services, 
Office of the Inspector General (OIG), and the Department of Justice through Strike 
Forces and CMS Field Offices in Miami and in Los Angeles to crack down on fraudulent 
and criminal activities in the Medicare program. These partnership efforts have resulted 
in several criminal cases, convictions, and plea bargain agreements. 

At the August 20, 2007, joint HHS/DOJ press conference announcing the Infusion 
Demonstration program, the US Attorney’s Office, Southern District of FL announced 
the filing of 20 criminal cases against 42 defendants: 

(1) United States vs. Frantz Achille, No. 06-20496-CR 

(2) United States vs. Onelio Baez, et ah. No. 05-20849-CR 

(3) United States vs. Gregory Delatour, No. 06-20029-CR 

(4) United States vs. Pedro Diaz, et al., No. 05-20869-CR 

(5) United States vs. Luis Manuel Fernandez, et al., No. 06-20322-CR 

(6) United States vs. Magda Lavin,No. 05-208 14-CR 

(7) United States vs. Thaiz Parra, et al., No. 06-60167-CR 

(8) United States vs. Isaac Nosovsky, et al., No. 06-20178-CR 

(9) United States vs. Rafael Walled, No. 06-20030-CR 

(10) United States vs. Rosa Walled, No. 06-20031-CR 

(1 1) United States vs. Cesar Romero, No. 06-20740-CR 

(12) United States vs. Arnold Garcia, et al.. No. 07-20057-CR 

(13) United States vs. Luis G. Henriquez Delgado, No. 07-20180-CR 

(14) United States vs. Jose Prieto, et ah, No. 07-201 77-CR 

(15) United States vs. Leider Alexis Munoz, No. 07-20225-CR 

(16) United States vs. Jorge Luis Mocega, et al.. No. 07-20419-CR 

(17) United States vs. Orestes Aivarez-Jacinto, MD, No. 07-20420-CR 

(18) United States vs. Lester Miranda, et al.. No. 07-20612-CR 

(19) United States vs. Rupert Francis, No. 07-2063 1-CR 

(20) United States vs. Rita Campos Ramirez, No 07-20633-CR (1) 

• The Medicare Fraud Strike Force, a multi-agency group begun in March 2007 in Miami, 
has brought 120 criminal and civil cases against more than 200 defendants. The total 
fraud involved in the South Florida cases amounts to over $638 million. 
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Improper Payments reporting and future goals for reducing Improper Payments 
CMS is firmly committed to ensuring the highest measures of financial accountability to the 
American people and our improper payment activities have helped focus our efforts to strengthen 
CMS’ stewardship over taxpayer dollars. With the size and scope of CMS programs and the 
limited resources available to combat fraud, we know that it is critical to prioritize and be 
aggressive in our activities to identify and take action to reduce improper payments. 

As required under the Improper Payments Information Act of 2002 (IPIA) (P.L. 1 07-300) and 
related guidance issued by OMB, CMS implemented methodologies to estimate improper 
payments for our programs: Medicare, Medicaid and SCHIP. 

As part of HHS’ FY 2007 Agency Financial Report, CMS reported a Medicare fee-for-service 
program error rate of 3.9 percent, a significant decrease from the 5.2 percent reported in 2005, 
and a reduction of greater than 50 percent from the 1 0. 1 percent rate reported in FY 2004. This 
is a cumulative savings to Medicare and the taxpayers of over $10 billion. With continued 
monitoring and error reducing efforts our goal is to achieve an error rate of 3.8 percent in 2008 
and 3.7 percent by 2009. 

In addition to the Medicare FFS program, CMS initiated programs to measure and report on 
improper payments in the Medicare Advantage or the Medicare Prescription Drug Benefit 
Programs (also referred to as Medicare Part C and Medicare Part D, respectively). In FY 2007, 
the CMS prepared a Part C Risk Assessment and a Part D Risk Assessment. CMS also measured 
a component rate for Medicare Advantage and the Medicare Prescription Drug Benefit programs. 
CMS provided an estimate of the payment system calculation discrepancy rate. Each of these 
programs reported less than a one percent component rate. CMS is expanding its payment error 
rate component reporting for Medicare Advantage and the Medicare Prescription Drug programs 
in the FY 2008 Performance & Accountability Report (PAR) or its equivalent. Once a baseline 
error rate is established CMS will report targets and continue to implement an Improper 
Payments Information Act compliant program. 

Our Medicaid error rate program is also underway. From FY 2002 - FY 2005, CMS conducted 
Medicaid payment error measurement pilot projects and collaborated with States to determine a 
systematic means of measuring payment error rates at the State and national levels. In FY 2007, 
CMS measured and reported a preliminary national Medicaid FFS error rate for FY 2006 claims 
in 17 states based on medical review and data processing reviews. CMS is in the process of 
completing the error rate measure for the FY 2006 claims and will report the fall-year Medicaid 
FFS rate in the FY 2008 PAR or its equivalent. In addition, CMS expects to report a 
comprehensive error rate for both the Medicaid and the SCHIP programs based on FY 2007 data. 
The comprehensive measurement will include measuring the FFS, managed care, and eligibility 
components for both the Medicaid program and SCHIP. 

Under the President’s Management Agenda improper payments initiative. Federal agencies are 
mobilizing people, resources, and technology to identify improper payments in high risk 
programs, establishing aggressive improvement targets, and implementing corrective actions to 
meet those targets expeditiously. Consistent with these efforts, CMS is firmly committed to 
ensuring the highest measure of accountability within our programs. Unfortunately, since 
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funding for these activities was capped in 2003, CMS has sustained an approximately $90 
million inflationary loss to our purchasing power that has seriously degraded the Agency’s 
ability to meet ongoing challenges. Thus, to preserve CMS' commitment to program integrity, 
the President’s FY 2009 budget requests $198 million in discretionary Health Care Fraud & 
Abuse Control funding to build upon programs with a proven record for accountability. We 
believe that without these additional resources to keep pace with inflation, CMS will be unable to 
devote needed payment error prevention and anti-fraud efforts to an ever expanding program. 
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Medicare Vulnerabilities: 

Payments for Claims Tied to Deceased Doctors 
J uly 9, 2008 


I. INTRODUCTION 

The Medicare program was created to provide health insurance for 
the elderly and the disabled. In 2007, Medicare paid more than $400 
billion to cover more than 43 million beneficiaries. 1 Despite its noble 
intentions, the Medicare program has faced a pervasive and persistent 
problem with fraud and abuse. In its fiscal year 2005 performance and 
accountability report, the Department of Health and Human Services 
(HHS) reported that Medicare paid an estimated $12.1 billion in 
improper payments for claims in 2005 and an estimated $21.7 billion in 
2004. Since 1990, the Government Accountability Office (GAO) has 
consistently designated the Medicare program as high risk for fraud, 
waste, and abuse, because of its size, complexity, and vulnerability to 
mismanagement and improper payments. 2 3 

Abuses particularly plague the Medicare Part B program, which 
pays for certain medical equipment and supplies - commonly called 
durable medical equipment (DME) or durable medical equipment, 
prosthetics, orthotics, and supplies (DMEPOS) - for eligible 
beneficiaries. According to the Centers for Medicare and Medicaid 
Services (CMS), the Federal agency that administers the Medicare 
program, abuses related to DME claims cost billions of dollars each 
year/ On March 8, 2007, the Chief Financial Officer of CMS testified 
before a Congressional committee that “[t]he fraudulent business 
practices of unscrupulous durable medical equipment, orthotics, 
prosthetics and supplies suppliers continue to cost the Medicare program 
billions of dollars.” 4 In 2007, GAO reported that CMS estimated that 
Medicare made improper payments based on mistakes, abuse, or fraud 
totaling approximately $700 million for DME supplies in one year alone. 


1 2008 Annual Report of the Boards of Trustees of the Federal Hospital Insurance and Federal 
Supplementary Medical Insurance Trust Funds at page 2. 

2 GAO-07-3 1 0, High-Risk Series: An Update, January 2007. 

3 Testimony of CMS Chief Financial Officer Timothy B. Hill before the House Ways and 
Means Subcommittees on Health and Oversight, March 8, 2007. The Centers for Medicare 
and Medicaid Services was formerly called the Health Care Financing Administration 
(HCFA). The name was changed in 2001. 

4 Id 
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According to GAO, these types of payments represented approximately 
7.5 percent of total payments made for DME items. 5 

In light of reports of abuses in the Medicare program, the U.S. 
Senate Permanent Subcommittee on Investigations (the Subcommittee) 
initiated an investigation into fraud, waste, and abuse in Medicare, with 
a particular focus on DME claims. The Subcommittee’s inquiry is also 
examining the efficacy of efforts to identify and prevent such abuses by 
CMS and its contractors. The Subcommittee’s investigation has 
included a detailed examination of data concerning millions of DME 
claims submitted between 1995 and 2007. The Subcommittee has also 
interviewed numerous officials from CMS, Medicare contractors, the 
Department of Justice Fraud Section, the Department of Health and 
Human Services Office of the Inspector General (HHS/OIG), as well as 
physicians, representatives of DME suppliers, Medicare beneficiaries, 
and DME suppliers who have been convicted of Medicare fraud. This 
Report presents the findings and recommendations of the Subcommittee 
staff on one aspect of the problem, the payment of Medicare DME 
claims referencing a prescribing physician who is deceased. 


II. EXECUTIVE SUMMARY 

Medicare regulations require that DME claims contain certain 
information in order to qualify for payment. 6 For instance, claims must 
include valid identification numbers for the beneficiary and the DME 
supplier. Another essential element is the identification number for the 
prescribing medical provider - the Unique Physician Identification 
Number, commonly called the UPIN. 

Over the course of its investigation into fraud, waste, and abuse in 
Medicare, the Subcommittee has uncovered a substantial volume of paid 
DME claims that contained UPINs for deceased physicians. 
Specifically, the Subcommittee staff estimates that, from 2000 through 
2007, Medicare paid for approximately 478,500 claims that contained 
the UPINs of deceased doctors, and the number of claims paid could be 
as high as 570,000. The Subcommittee staff also estimates that the 
amount of money paid for these claims is well over $76.6 million, and it 
is possible that the number actually exceeds $92 million. 7 The 


s GAO-07-59, Medicare: Improvements Needed to Address Improper Payments for Medical 
Equipment and Supplies, January 31, 2007. 

6 Medicare Claims Processing Manual, Chapter 1, Section 80.3,1 through 80.3.2. 

7 All estimates presented here are based on a 95-percent confidence level, as discussed in 
greater detail in Footnote 44 below. For the number of claims submitted to Medicare with 
deceased physician UPINs, tire 95-percent confidence interval ranges from a low of 384,730 
claims to a high of 572,268 claims. For the Medicare expenditures on claims containing 
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Subcommittee’s analysis indicates that these Medicare claims contained 
the UPINs of between 16,500 and 18,200 deceased physicians. Sixteen 
percent of the estimated 478,500 claims, amounting to 51,534 claims 
valued at roughly $4 million, contained UPINs of doctors who died 10 
or more years before the service date on the claims. 8 The Subcommittee 
also found that an estimated 2,000 to 2,900 deceased physicians still had 
active UPINs as of May 2008. 9 

Because of the high number of Medicare claims and reports of 
fraud, waste, and abuse in Florida, the Subcommittee also examined 
claims using deceased physician UPINs in that State. The 
Subcommittee’s investigation uncovered alarming case studies that 
included one UPIN that was used in 484 claims, totaling more than 
$544,000, that were paid more than six years after the death of the 
prescribing physician. Similarly, the Subcommittee discovered that the 
UPIN assigned to one doctor who died in 2001 was used in more than 
3,800 claims submitted between 2002 and 2007, resulting in Medicare 
payments of more than $354,000. In another instance, the 
Subcommittee found that the UPIN of a physician who died before 1999 
was used on more than 1,600 claims submitted after April 2002, 
resulting in Medicare payments of more than $478,000. 

These problems are not new. In November 2001, HHS/OIG 
reported that Medicare paid $91 million in 1999 for medical equipment 
and supply claims with invalid or inactive UPINs. HHS/OIG 
recommended that CMS: (1) revise its claims process to ensure that 
UPINs listed on medical equipment and supply claims are valid and 
active; and (2) emphasize to suppliers the importance of using accurate 
UPINs when submitting claims to Medicare. CMS agreed with 
HHS/OIG’s recommendations and, in its written comments to the report, 
stated that on April 1, 2002, it would provide instructions and implement 
changes to its automated claims processing system to reject medical 
equipment and supply claims using deceased physician UPINs. 10 


deceased physician UPINs, the 95-percent confidence interval ranges from a low of 
$60,317,099.12 to a high of $92,819,900.74. 


s 


The 95-percent confidence interval for the claims tied to doctors who died at least 10 years 
before the listed service date ranges from 26,915 to 76,154. The 95-percent confidence 
interval for the amount of money paid for those claims ranges from a low of $2,000,595.81 to 
a high of $5,793, 33 1.90. 


The estimate for the number of deceased doctors with active UPINs as of May 2008 was 
generated by calculating the proportion of doctors within the sample that had active UPINs as 
of May 2008, and estimating the population proportion and confidence interval using the 
equation: . 


10 HHS/OIG, Medical Equipment and Supply Claims with Invalid or Inactive Physician 
Numbers, November 2001 . 
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After the issuance of the HHS/OIG report, CMS took several steps 
to reject claims containing UPINs assigned to deceased physicians. For 
example, CMS instructed its claims processing contractors to perform a 
one-time review of its UPIN registry and in-house provider files to 
deactivate UPINs for doctors who were deceased or did not file any 
claims from their practices for 12 months. 11 CMS further directed its 
claims processing contractors, beginning on April 1, 2002, to reject 
claims using invalid or inactive UPINs. CMS also announced that it 
would make changes to its payment systems to ensure that claims using 
invalid or inactive UPINs would be automatically rejected. 

Despite these actions, the Subcommittee investigation found that 
claims with deceased physician UPINs were still not automatically 
rejected. To the contrary, payment data supplied by CMS showed that 
Medicare paid claims containing UPINs from physicians who had died 
more than 12 months prior to the dates of service on the claims. In fact, 
63 percent of the claims identified by the Subcommittee as using 
deceased physician UPINs were paid with dates of service after April 1, 
2002, the date after which Medicare was supposed to reject such claims. 

Apparently, neither CMS, the HHS/OIG, nor the claims processing 
contractors performed the reviews or audits needed to ensure that the 
steps taken in 2002 were effective in stopping the payment of Medicare 
claims using deceased physician UPINs. This oversight failure resulted 
in tens of millions of dollars in improper payments. 

A. Report Findings 

Based upon its investigation, the Subcommittee staff makes the 
following findings of fact. 

1. Tens of Millions Paid for Medicare Claims With 
Deceased Physician UPINs. From 2000 to 2007, 
Medicare paid an estimated $60 million to $92 million 
for hundreds of thousands of DME claims that 
contained identification numbers assigned to an 
estimated 16,500 to 18,200 deceased physicians. 

2. CMS Actions Taken in 2002 to Stop Deceased 
Physician Claims Failed. In 2002, CMS implemented 
procedures to ensure that DME claims with UPINs of 
deceased physicians would be rejected, but those 
procedures were ineffective in resolving the problem, 
and HHS and CMS personnel failed to perform the 
reviews or audits needed to ensure the procedures were 
working. As a result, CMS has paid claims containing 


" Id atpg. 2. 
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UPINs assigned to deceased doctors years after their 
death. 

3. Medicare Remains Unprotected from Deceased 
Physician Claims. As of May 2008, the UPINs of an 
estimated 2,000 to 2,900 deceased physicians remained 
active, until replaced by the National Provider Identifier 
number (NPI). The continuing inability of CMS’s 
payment systems to reject claims containing deceased 
physician identification numbers renders Medicare 
vulnerable on a continuing basis to millions of dollars 
in improper claims each year. 


B. Report Recommendations 

After being informed of the Subcommittee’s investigative findings, 
CMS did not dispute them, but told the Subcommittee that CMS is 
currently undergoing substantial changes in the way Medicare claims are 
processed, including recent changes to physician and DME supplier 
identification numbers. 12 Specifically, over the past year, CMS has 
terminated the UPIN registry and replaced UPINs with a new National 
Provider Identifier (NPI) numbering system for all Medicare service 
providers. 13 Beginning in May 2008, NPIs are required to be submitted 
for all Medicare claims. 

Based upon the Subcommittee’s investigative findings and the 
ongoing reform of the Medicare claims review processes, the 
Subcommittee staff makes the following recommendations. 

1. Strengthen Procedures to Deactivate NPIs after Physician 
Death. CMS should examine its procedures for identifying 
deceased physicians to ensure timely receipt of deceased 
physician data, automatic deactivation of relevant NPI numbers, 
and continual update of the NPI registry. CMS should develop 
a quality control program to ensure NPIs are deactivated within 
a specified period of time after receiving notice of a physician’s 
death, such as 90 days. 

2. Initiate Regular NPI Registry and Claim Audits. CMS 

should initiate periodic audits of its NPI registry to test whether 
NPI numbers assigned to deceased physicians have been 
deactivated within the specified timeframe and to test Medicare 
payment records to determine whether claims containing 
deceased physician NPIs were rejected. 

12 CMS’s responses are produced in Appendices II and III below. 

13 45 CFRPart 162, Federal Register, Vol. 69, No. 15, January 23, 2004, at pg. 3434. 
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3. Consider Additional Procedures and Audits to Strengthen 
NPI Registry. CMS should consider instituting additional 
procedures and audits to ensure the prompt deactivation of NPIs 
assigned to Medicare service providers who have stopped 
providing services due to licensure revocation, retirement, or 
other reasons, including automatic deactivation of any NPI that 
has not been used in a Medicare claim within a specified time 
period, such as 12 months. Consideration should also be given 
to developing procedures to allow deactivated NPIs to be 
reinstated upon proper application. 

III. BACKGROUND 

A. Overview of Medicare and Durable Medical 
Equipment Claims 

1. Medicare and DME in General 

Title XVIII of the Social Security Act (SSA), entitled “Health 
Insurance for the Aged and Disabled,” established the Medicare program 
in 1965. 14 Medicare was created to provide health insurance for the 
aged, disabled, and persons with end-stage renal disease. The program 
is administered by HHS through CMS. 

Medicare is comprised of four parts. Part A, the Hospital 
Insurance Program, covers hospital services, post-hospital services, and 
hospice services. Part B, the Supplementary Medical Insurance 
Program, covers medical services including physician, laboratory, 
outpatient services, and DME. Part C covers managed care options for 
beneficiaries enrolled in Part A and Part B. Part D, created by the 
Medicare Prescription Drug Improvement and Modernization Act of 
2003, covers outpatient prescription drug benefits as of January 1, 
2006. 15 For the purposes of this Report, the Subcommittee will focus on 
Medicare Part B. 

Under Part B, the Medicare program will pay for certain DME for 
eligible Medicare beneficiaries under the DMEPOS benefit. 16 The term 
DME refers to medical equipment and supplies that are used in the 
patient’s home (including an institution such as a nursing home in which 
the patient resides). 17 Medicare regulations define DME as: 


14 Title XVIII appears in the United States Code at 42 U.S.C, §§ 1395-1395(ccc). 

1 3 Prior to this date, many prescription drugs were covered under Medicare Part B. 

16 SSA Section I833(a)(l)(I). 

17 SSA Section 1861 (n). 
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[Equipment furnished by a supplier or a home health 

agency that: 

( 1 ) Can withstand repeated use; 

(2) Is primarily and customarily used to serve a 
medical purpose; 

(3) Generally is not useful to an individual in the 
absence of an illness or injury; and 

(4) Is appropriate for use in the home. 1 8 

Examples of DME include wheelchairs, oxygen condensers, nebulizers, 
canes, hospital beds, prosthetics, diabetic equipment and supplies such 
as blood glucose test strips, and some prescription medications. 

2. DME Claims and Suppliers 

The Medicare claims process for DME typically involves three 
parties: (1) the Medicare beneficiary who is prescribed certain medical 
supplies or equipment; (2) the medical practitioner, such as a physician, 
nurse practitioner, or physician assistant who is treating the beneficiary 
and prescribing the equipment; and (3) the DME supplier, a private 
entity authorized by CMS to provide DME items to Medicare 
beneficiaries and bill Medicare directly. The process of a DME claim 
generally starts with the Medicare beneficiary receiving treatment from a 
medical practitioner. If the physician writes an order or prescription for 
DME, the beneficiary can take the prescription to a DME supplier of his 
or her choosing and the DME supplier sells or rents the prescribed item 
to the beneficiary. 19 

In most circumstances, the DME supplier submits a claim for 
payment to an entity authorized by CMS to receive, review, and process 
Medicare claims, such as a Durable Medical Equipment Regional 
Carrier (DMERC) or other Medicare carrier. DMERCs were established 
to standardize the coverage and payment of DME claims and were 
designed to be the experts in the Medicare DME claims process. Their 
primary role was to accept and process Medicare Part B DME claims. 
In doing so, DMERCs were also expected to consolidate and focus 
efforts to combat fraud, waste, and abuse in the DME benefit program. 20 


18 42 CFR 414.202. 

19 For certain DME, including equipment that is expensive and prone to fraudulent activity, 
CMS regulations require the physician to provide a Certificate of Medical Necessity (CMN) 
in addition to a prescription. For instance. Medicare requires a CMN for oxygen or infusion 
pumps. A CMN is a form required to help document the medical necessity and other 
coverage criteria for selected DMEPOS. Medicare Claims Processing Manual, Chapter 20, 
Section 100.2. 

20 Section 91 1 of the Medicare Modernization Act of 2003, known as the Medicare Contracting 
Reform provision, required CMS to compete all currently held contracts for administration of 
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Physicians generally file Medicare claims that deal with treatment, 
office visits, and other medical procedures, while DME claims are 
typically submitted by suppliers. As noted above, DME suppliers are 
entities that are authorized by the Medicare program to sell or rent DME 
to eligible beneficiaries and submit claims for payment directly to 
Medicare. DME suppliers typically include pharmacies or companies 
that specialize in DME such as wheelchairs, oxygen supplies, diabetic 
supplies and other supplies and equipment that are provided to Medicare 
beneficiaries, as well as other medical patients. 

B. Unique Physician Identification Numbers 

The Omnibus Budget Reconciliation Act of 1985 required CMS to 
establish UPINs for all physicians who provide services to Medicare 
beneficiaries. 21 Under the UPIN system, each physician was assigned 
one unique number that never changed. CMS contracted with one 
company, National Heritage Insurance Company Corporation (NHIC), 
to manage the UPIN registry, a database containing detailed information 
about each physician approved to submit Medicare claims, including the 
practice settings of each physician assigned a UPIN. 22 The database 
included an Internet component, available to the public, that could be 
used to verify a physician’s UPIN or other data such as name or practice 
location. 23 

In addition, since 1992, Medicare regulations have required DME 
suppliers to provide the UPIN of the physician who ordered the DME 


the fee-for service Medicare program. The new contractors selected through these 
competitions are called Medicare Administrative Contractors (MACs). DME MACs are the 
new contractors for DME services. 

21 UPINs were phased out of the Medicare program on May 23, 2008, in favor of a new 
numbering system involving NPIs. The Health Insurance Portability and Accountability Act 
of 1 996 (HIPAA) required the development of the NPIs to be used by all entities who file 
claims with Medicare. As a result, no new UPINs have been issued since June 2007, and all 
Medicare claims are now required to have NPIs. 

22 According to the definition provided on the NHIC website, “a practice setting is defined as a 
specific location at which a physician, medical group, or non-physician practitioner renders 
service. It is physically separate from any other location in which he or she renders service.” 
See http://www.upinregistry.eom/faq.asp#6. 

23 The UPIN online registry was terminated on May 23, 2008. According to the CMS website 
at http://www.cms.hhs.gov/nationalprovidentstand: 

The NPI will be Required for all HIPAA Standard Transactions on May 23rd. 

This means: 

For all primary and secondary provider fields, only the NPI will be accepted 
and sent on all HIPAA electronic transactions . . . [and] paper claims .... 

The reporting of Medicare legacy identifiers in any primary or secondary 

provider fields will result in the rejection of the transaction. 

A similar website has been established for the NPI system, which is managed by 

Fox Systems, Inc. under contract with CMS. 
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items on all claims submitted to Medicare for payment. The regulations 
state that claims without a valid UPIN must be denied. 24 In its response 
to Subcommittee questions, CMS summarized these regulations as 
follows: 

The effective date for requiring the LIPIN of the 
ordering/referring physician for all services was January 1, 

1992. As required by section 1833(q) of the Social Security 
Act, all claims for Medicare covered services and items that 
are the result of a physician’s order or referral must include 
the ordering/referring physician’s name and UPIN, This 
includes parenteral and enteral nutrition, immunosuppressive 
drug claims, diagnostic laboratory services, diagnostic 
radiology services, consultative services, and durable medical 
equipment. Claims for other ordered/referred services not 
included in the preceding list must also show the 
ordering/referring physician’s name and UPIN. All 
physicians who order or refer Medicare beneficiaries or 
services must obtain a UPIN even though they may never bill 
Medicare directly. A physician who has not been assigned a 
UPIN must contact the Medicare carrier. ... If durable 
medical equipment, prosthetics and orthotics are ordered, the 
name and UPIN of the ordering physician must be on Form 
CMS-1500 in items 17 and 17a. 

C. 2001 HHS Inspector General Report 

In 2001, the HIIS/OIG published a report analyzing the payment of 
Medicare claims containing invalid or inactive UPINs. 25 The study 
found that, in 1999, Medicare paid $32 million for medical equipment 
and supply claims with invalid UPINs and an additional $59 million for 
claims with inactive UPINs. The HHS/OIG recommended that CMS 
revise the claims processing procedure to ensure: (1) that claims are 
paid only if they contain valid and active UPINs; and (2) that CMS 
emphasize to suppliers the importance of using valid UPINs when 
submitting claims. The HHS/OIG reported that, according to CMS, the 
then-existing Medicare claims processing system only verified that 
UPINs on claims met certain format requirements and did not reject 
UPINs that were invalid or inactive. 


24 Medicare Claims Processing Manual, Chapter 1, Section 80.3.2.1.2. This same restriction also 

applies to NPIs. 

25 HHS/OIG, Medical Equipment and Supply Claims with Invalid or Inactive Physician 
Numbers, November 200 1 . 
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CMS reviewed the HHS/OIG report prior to its release and 
concurred with its recommendations. In commenting on the report, the 
then-CMS Administrator stated: 

Since the OIG study, CMS has developed instructions, 
system changes, and edits which will reject medical 
equipment and supply claims using a deceased physician’s 
UPIN. The implementation date for this initiative is April 1, 

2002. After this initiative is implemented, CMS will expand 
it to include inactive and invalid UPINs. 

CMS also concurred with the HHS/OIG’s recommendation to educate 
Medicare service providers on the importance of submitting accurate 
UPINs on Medicare claims. In November 2001, the HHS/OIG 
acknowledged CMS actions taken to resolve the problem of deceased 
physician claims identified in the 2001 report, but also urged CMS to 
perform post-payment reviews in order to detect the use of invalid or 
inactive UPINs on claims after the new initiative’s implementation. 26 

D. CMS Efforts to Ensure Rejection of 
Deceased Physician Claims 

Following the 2001 HHS/OIG report, CMS took a number of steps 
to ensure Medicare claims containing deceased physician UPINs were 
not paid. In the latter half of 2001, CMS told the HHS/OIG that it had 
developed a new claims review process that would reject claims 
containing UPINs of deceased physicians. CMS indicated that this new 
process was to be implemented on April 1, 2002. 27 CMS also stated 
that, in addition to resolving the deceased physician problem, it would 
put mechanisms in place to ensure that all claims with invalid or inactive 
UPINs were not accepted. CMS stated that it would advise its carriers to 
deactivate all UPINs for which there had been no claim activity from the 
practice setting during the previous 12 months. 

On November 9, 2001, CMS issued a program memorandum to the 
DMERCs, instructing them to conduct a one-time review of deceased 
physician UPINs being used on DME claims. 29 The purpose of this one- 
time review was to identify UPINs belonging to deceased physicians, 
verify the remaining UPINs being used on DME claims, and update the 
DMERCs’ provider files and the UPIN Registry with the verified 
information. 


26 id. 

27 id. 

28 id. 

‘ 9 HHS/CMS, Program Memorandum Carriers, Reviewing Deceased Physicians’ Unique 
Physician Identification Numbers (UPINs) on DMERC Claims, Transmittal B-OI-73, Change 
Request 1735, November 9, 2001. 
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To implement the program memorandum, the DMERCs and other 
Medicare carriers were required to reconcile a UPIN file of deceased 
physicians that was attached to the program memorandum against their 
in-house provider files. Additionally, carriers were instructed to 
deactivate UPINs that had no claim activity for 12 months and include 
this information in their update of their in-house provider files and the 
UPIN registry. Carriers were instructed to provide a monthly progress 
report of their completed work on this project to CMS beginning January 
4, 2002. The goal of this one-time effort was to ensure that the 
Medicare claims processors would be working with an updated and 
validated UPIN registry by April 2002. 


In addition to establishing procedures for updating the UPIN 
registry, the November 2001 program memorandum stated that, 
effective April 1 , 2002, the Medicare Common Working File (CWF) 30 
was required to reject DMERC claims with UPINs whose date of service 
came after the physician’s date of death. 31 CMS told the Subcommittee 
that, as of April 2002, the CWF began rejecting DMEPOS claims with 
deceased physicians’ UPINs when the date of service came after the date 
of death. 3 ' CMS also indicated that if a UPIN was missing on a claim 
form or an entry was not in the proper format, the contractors would 
reject the claim and return it as unprocessable to the provider or supplier 
for correction. 


CMS told the Subcommittee that the file containing deceased 
physicians’ UPINs were supposed to be updated with deceased 
physician data every 15 months. 33 To ensure accurate data, CMS told 
the Subcommittee that the UPIN registry contractor set up a system with 
the American Medical Association (AMA) to obtain biweekly data 
specifying the date of death for deceased physicians across the country. 
The UPIN registry contractor then compared the AMA data to the data 
in the registry, identified registered physicians who had died, and issued 


30 The Common Working File is the master record of all Medicare beneficiary information and 
claim transactions, including both Medicare Part A, Part B and DME data. The claims 
processing systems interface with the CWF to verify the beneficiary’s entitlement to 
Medicare, deductible status and available benefits. The CWF also reviews claims history to 
check for duplicate services, inpatient or Skilled Nursing Facility (SNF) stays, and other 
insurance that may pay primary to Medicare, secondary to Medicare or should pay in place of 
Medicare. As a final step in processing, most claims are sent to the CWF for review and 
validation of claim data. 

31 CMS letter to the Subcommittee, June 4, 2008, answers to Questions 1 and 4, reprinted in 
Appendix II of this Report. CMS issued a subsequent program memorandum on April 12, 
2002, that stated that for a claim to be properly adjudicated, the physician’s date of death 
would need to be included in the information provided by the carriers. The effective and 
implementation date for this program memorandum was October 1, 2002. HHS/CMS, 
Program Memorandum Carriers, Deceased Physician UPIN Information - (Transmittal B-01- 
73), Transmittal B-02-024, Change Request 2042, April 12, 2002. 

32 Id,, answers to Questions 1 , 4, and 5. 

33 Id . , answer to Question 5. 
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a monthly report identifying the deceased registry physicians to 
Medicare’s claims processing contractors that were supposed to update 
their in-house physician lists. 4 

To further ensure that appropriate UPINs were being deactivated, 
CMS told the Subcommittee that, in September 2002, it sent a program 
memorandum instructing its contractors to educate and train Medicare 
service providers about their responsibility to ensure that accurate 
UPINs are used on claims. 35 

CMS told the Subcommittee that the actions described in the 
November 2001 and September 2002 program memoranda were, in fact, 
carried out. 36 Additionally, in CMS’s response to the OIG report of 
November 2001, CMS indicated they would also implement changes to 
the claims process that would reject claims using invalid and inactive 
UPINs, other than those assigned to deceased physicians. 37 In its fiscal 
year 2004 semiannual report to Congress, however, the HHS/OIG stated 
that CMS had decided against implementing changes to its automated 
claims processing system and the CWF to block the payment of 
Medicare claims containing inactive or invalid UPINs, opting instead to 
rely on provider-education efforts and its two program memorandums to 
stop service providers from submitting claims with deceased physician 
UPINs. 38 


IV. MEDICARE CLAIMS PROCESS ALLOWED PAYMENTS 

FOR DECEASED PHYSICIAN CLAIMS 

Problems in the Medicare program have been long-standing and 
well-documented. Oversight bodies such as HHS/OIG and GAO have 
reported program integrity issues in the Medicare program for many 
years. In HHS’s fiscal year 2007 agency financial report, HHS/OIG 
reported integrity of Medicare payments as one of the agency’s top 
management and performance challenges. 39 In its 2007 High-Risk 
Series, GAO reported that further action was needed to address program 
integrity weaknesses. 40 Moreover, the HHS/OIG and GAO continue to 
find program weaknesses, specifically in the area of DME. In HHS’s 


34 Id., answers to Questions 2 and 5. 

35 CMS stated that the instructions were reported in program memorandum AB-02-1 and had an 
effective date of October 1, 2002. 

36 Id., answers to Questions 1 and 2. 

37 HHS/OIG, Medical Equipment and Supply Claims with Invalid or Inactive Physician 
Numbers, November 2001. 

3S HHS/OIG Semiannual Report to Congress, April 1 , 2004 - September 30, 2004. 

39 Department of Health and Human Services, Fiscal Year 2007 Agency Financial Report, 
November 15, 2007. 

40 GAO-07-3 1 0, High-Risk Series: An Update, January 2007. 


12 



95 


fiscal year 2007 agency financial report, HHS/OIG reported that it has 
consistently found that the Medicare DMEPOS benefit is vulnerable to 
fraud and abuse. To illustrate the point that action is needed to enhance 
Medicare program integrity, GAO pointed out that, while Medicare’s 
fiscal year 2006 improper payment error rate was the lowest since 1 996, 
certain providers - such as suppliers of DME - continued to receive 
improper payments at a higher rate. 

In the case of deceased physician claims, the Subcommittee’s 
investigation has found that, despite the 2001 HHS/OIG report that 
found CMS paid millions of dollars for claims with invalid or inactive 
UPINs and the actions taken by CMS to address the problem, CMS has 
failed to ensure claims containing only valid UPINs are paid. Since the 
UPIN is one of the key pieces of data required on claims, the failure of 
Medicare claims processing contractors to automatically reject claims 
with an invalid UPIN rendered the program susceptible to tens of 
millions of dollars in fraud, waste, and abuse. Further, the failure of the 
Medicare system to routinely deactivate UPINs belonging to deceased 
physicians created a program vulnerability that allowed DME suppliers 
to be paid for improper claims. When the Subcommittee presented to 
CMS its own payment data showing that, from 2000 to 2007, millions of 
dollars had been paid on Medicare claims containing deceased physician 
UPINs, CMS did not challenge either the payment data or the 
Subcommittee’s interpretation of that data. 41 

A. From 2000 to 2007, Medicare Paid Between $60 Million 
and $92 Million for Hundreds of Thousands of DME 
Claims Containing Deceased Physician UPINs 

The Subcommittee obtained comprehensive data concerning more 
than 33,000 deceased physicians from the AMA and selected a 
statistically random sample of 1,500 deceased physicians for further 
analysis. The Subcommittee obtained the UPINs belonging to the 
deceased physicians in the sample and obtained DME claims data from 
Medicare related to those 1,500 UPINs. 42 

Of the 1 ,500 UPINs for deceased physicians that the Subcommittee 
examined, 734 (48.9 percent) had been used on claims with dates of 
service between January 1, 2000, and December 31, 2007. For these 
734 UPINs, 21,458 claims were submitted for payment. The total 
amount paid for these claims was $3.4 million. 43 In addition, more than 


41 See CMS responses reprinted in Appendices II and III; Subcommittee interview of CMS 
officials, June 5, 2008. 

42 See Appendix I for more information about the scope and methodology of the 
Subcommittee’s analysis. 

43 The Subcommittee reviewed only claims that contained services dates that occurred more 
than 12 months after the physicians’ deaths. Had the Subcommittee considered ali claims 

13 



96 


55 percent of the total claims were for dates of service at least five years 
after the physicians had died. The Subcommittee also found that 1,618 
claims totaling more than $234,000 contained the UPINs of physicians 
who had died at least 10 years before the date of service on the claim. 
Further, the Subcommittee noted that 110 of the 1,500 deceased 
physicians (roughly 7 percent) had active UPINs as of May 21, 2008. 

Based on the results of the random sample, the Subcommittee 
estimates with 95 percent certainty that, from 2000 to 2007, Medicare 
paid 478,500 claims containing UPINs that were assigned to deceased 
physicians. 44 The total amount paid for these claims is estimated to be 
between $60 million and $92 million. 45 These claims contained UPINs 
for an estimated 16,548 to 18,240 deceased physicians. In addition, 
based on the results of the random sample, the Subcommittee estimates 
that between 2,01 1 and 2,895 deceased physicians still had active UPINs 
as of May 2008. 

Notably, approximately 11,582 (54 percent) of the 21,458 claims 
that were paid were for dates of service after the physicians had been 
dead at least five years, and almost 15,599 (73 percent) of the claims 
paid contained the UPINs of physicians who had died before January 
2000. Additionally, roughly 13,474 (63 percent) of the claims were paid 
with dates of service after April 1, 2002, the date CMS said it would 
implement new procedures to ensure claims with deceased doctors’ 
UPINs were rejected. Table 1 presents claims reviewed by the 
Subcommittee: 


with dates of service after physician deaths, including claims within 12 months of the 
physicians’ deaths, the amount of claims paid for the random sample of 1,500 doctors would 
have been roughly $4.1 million rather than $3.4 million. The total number of UPINs of 
deceased physicians would also increase from 734 to 777, and the total number of claim 
would also have grown from 35,717 to 43,619. 

44 For the number of claims submitted to Medicare with deceased physician UPINs, the 95- 
percent confidence interval ranges from a low of 384,730 claims to a high of 572,268 
claims. Estimates of 95-percent confidence intervals were generated as follows. First, a 
statistically random sample of 1,500 doctors was drawn from the population of deceased 
doctors with assigned UPINs. The mean (£*£* ) and standard deviation (SSESS ) of the 
number of claims filed per UPIN, and of the amount of money paid out per UPIN, was 
computed for the sample. These means and standard deviations were used to generate a 
confidence interval of the sample mean number of claims filed per UPIN, and the sample 
mean amount of money paid out per UPIN using an alpha of .05 and the equation: + i. 96 (i) - 
The sample means and upper and lower bounds of the sample confidence intervals were then 
multiplied by the population size to generate population estimates. All ranges given above 
are thus estimated with a 95 -percent level of confidence. 

45 The 95 -percent confidence interval for the Medicare expenditures on claims containing 
deceased physician UPINs ranges from a low of $60,317,099.12 to a high of $92,819,900.74. 
The mean total for this amount is estimated to be $76.6 million. As noted above, this 
estimate includes only claims that contained services dates that occurred more than 12 
months after the physicians’ deaths. Including all claims with dates of service after 
physicians’ deaths, such as claims within 12 months of the physicians’ deaths, the estimate 
for the amount paid by Medicare for deceased physician claims would likely have increased 
to more than $100 million. 
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Dale Physician License 
Status \\ as Changed to 
Diicaswl' 11 ’ 

Dates of Sl i v iee 

on Medicare Claims 

Number 

of 

Claims 

Total 

Amount Paid 

September 22, 1993 

January 2000 to March 2002 

396 

$ 81,793 

January 1, 1999 

January 2000 to December 2007 

653 

$ 92,033 

June 15, 1996 

June 2000 to July 2006 

101 

$148,749 


Table 1: Examples of Deceased Doctor Claims from the AMA Data 


B. Florida Case Studies: CMS Paid Millions of Dollars 
for Claims Containing Deceased Physician UPINs 

The Subcommittee also examined DME claims that contained 
UPINs of deceased Florida physicians. In its analysis, the 
Subcommittee considered only those claims for dates of service after 
April 1, 2002, the date on which Medicare was to implement new 
initiatives to prevent the payment of claims containing UPINs of 
deceased physicians. This aspect of the Subcommittee’s review found 
that, from April 1, 2002, through December 31, 2007, more than $2 
million had been paid for claims with UPINs belonging to 1 14 deceased 
Florida physicians. Moreover, the data obtained by the Subcommittee 
indicated that more than 27 percent of the deceased Florida physicians 
had active UPINs as of May 2008. 

In its review, the Subcommittee found as many as 484 claims 
totaling $544,789 filed under a single UPIN years after the physician 
had died. Table 2 below outlines examples of claims filed using UPINs 
assigned to deceased Florida physicians who died more than 12 months 
before the dates of service on the claims. 


4t> The date the license status was changed may not be the date of actual death. For example, 
for the physician identified in the following table whose license status was changed on 
January 29, 2002, the State of Florida Office of Vital Statistics confirmed this physician died 
on September 10, 1999. 
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Dale Physician License Status 
Was Changed to Deceased 

Dates of Service on Medicare 
Claims 

Number 
of Claims 

Total 

Amount Paid 

July 2, 1999 

July 1, 2002 to 
December 31, 2007 

2,062 

$ 478,985 

July 7, 1999 

April 17, 2003 to 
November 1 7, 2003 

67 

$ 61,302 

October 4, 2001 

October 4, 2002 to 
December 31, 2007 

3,848 

$ 354,277 

November 15, 2001 

December 6, 2002 to 

May 8, 2005 

265 

$ 229,527 

January 29, 2002 

July 1, 2003 to 
November 14, 2006 

484 

$ 544,789 

March 1,2002 

March 17, 2003 to 
August 30, 2006 

433 

$317,698 


Table 2: Examples of Deceased Doctor Claims from Florida Data 


The Subcommittee’s investigation has also uncovered links 
between claims containing deceased physician UPINs and claims found 
to be related to fraudulent activity. A review of the details on the claims 
submitted using the UPINs of the 114 deceased physicians in Florida, 
for example, revealed an alarming number of claims submitted by 
companies identified by the U.S. Department of Justice and state 
regulatory agencies as having submitted fraudulent Medicare claims 
worth millions of dollars. 

In one instance, the Florida data contained claims from 
Professional Gluco Services, Inc. (Professional Gluco), a DME supplier. 
In a press release regarding the indictments of that company’s officials, 
the Department of Justice stated the following: 

On September 25 , 2007 , a Miami federal grand jury returned 
a five (5) count indictment against two defendants in United 
States v. Nelson Martin and Aurelio Benavides, No. 07- 
20765-Cr-Huck, The Indictment charges Nelson Martin and 
Aurelio Benavides, with owning and operating Professional 
Gluco Services, Inc. (“Professional Gluco”), a Miami durable 
medical company, and executing a scheme to submit tens of 
millions of dollars in fraudulent claims to Medicare from 
November 2005 to September 2006 for reimbursement for 
durable medical equipment (DME) and related services. The 
Indictment alleges that the defendants submitted 
approximately $14.3 million in false claims on behalf of 


16 





99 


Professional Gluco. The claims were allegedly fraudulent in 
that the equipment had not been ordered by a physician 
and/or had never been delivered to a Medicare patient. As a 
result of the submission of the fraudulent claims, Medicare 
paid Professional Gluco approximately $1.3 million. 47 

Professional Gluco Services, Inc. is one of the companies that had 
submitted DME claims to Medicare using the physician’s UPIN who 
had died in September 1999. Professional Gluco submitted 83 claims 
under this physician’s UPIN between December 2005 and July 2006 and 
was paid $93,171. 

Another DME supplier identified in the Subcommittee’s review 
was the subject of a Florida Department of Health Administrative 
Complaint filed on June 21, 2007. The complaint stated that, when a 
Department of Health investigator attempted to inspect the business on 
December 11, 2006, the investigator found the business closed and the 
phone disconnected. The business did not notify the State of Florida, as 
required. The Florida Department of State - Division of Corporations 
lists the company as being voluntarily dissolved on February 1, 2007. 
Yet claims from this company using the same UPIN as Professional 
Gluco were paid by Medicare for dates of service between July 11, 
2006, and November 14, 2006, in the total amount of $167,101. 

A third company was also the subject of an Administrative 
Complaint filed by the Florida Department of Health. A Department of 
Health investigator attempted to inspect the purported business on 
February 26, 2007, and found the business closed and the phone 
disconnected. This business had filed claims using the same deceased 
physician’s UPIN that Professional Gluco used for dates of service 
between June 16, 2006, and August 7, 2006. The total amount paid for 
these claims was $143,631. 

Altogether, of the Florida data reviewed by the Subcommittee, at 
least $348,000 paid for Medicare claims containing deceased physician 
UPINs went to companies known to have submitted fraudulent DME 
claims. 

C. CMS Efforts to Reject Claims Containing Deceased 
Physician UPINs Failed 

CMS took a number of actions to stop the payment of Medicare 
claims containing deceased physicians UPINs, including requiring a 
one-time update of the UPIN registry to eliminate deceased physician 
UPINs and validate the remaining UPINs; instructing its claims 
processing contractors to deactivate UPINs with no claims activity after 
one year; and requiring them to reject claims with invalid or inactive 
UPINs after the April 1, 2002, deadline. CMS also told the 


1 ' See http://nriiami.fbi.gov/dojpressrel/pressrel07/mm20070928.htm. 
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Subcommittee that it had instituted system changes to require the CWF 
to automatically reject claims with invalid or inactive IJPINs, and 
instructed the UPIN registry contractor to update the registry with 
deceased physician data every 1 5 months. 

The Subcommittee’s analysis of CMS payment data shows, 
however, that those measures were not fully effective, and claims with 
deceased physician UPINs continued to be paid. For example, CMS had 
instructed its UPIN registry contractor to update the UPIN registry and 
review it on a regular basis to ensure deceased physician UPINs were 
being deactivated. The Subcommittee’s investigation demonstrated, 
however, that the UPIN registry continued to list deceased physician 
UPINs as active up to the date the registry was taken offline in May 
2008. The Subcommittee found, for instance, that approximately 7 
percent of the deceased physician UPIN sample from the AMA data still 
had active UPINs in May 2008, even though the physicians had all died 
prior to December 31, 2002. The Subcommittee also reviewed deceased 
physician data for particular States, including Alabama and Connecticut, 
and determined that between 5 and 7 percent of deceased physicians in 
those States also had active UPINs as of May 2008. Additionally, the 
deceased physician data from Florida indicated that approximately 27 
percent of the deceased physicians in that State still had active UPINs as 
of April 2008. 

CMS had also instructed the DMERCs and other claims processing 
contractors to review and update their in-house Medicare service 
provider lists to eliminate deceased physicians by April 1, 2002. Yet 
Medicare continued to pay claims with deceased physician UPINs after 
the April 1, 2002, implementation date. In fact, 63 percent of the 
deceased physician claims discovered by the Subcommittee were paid 
for dates of service after April 1, 2002, and thousands of claims included 
UPINs assigned to physicians who had died before 1999. Therefore, 
while CMS instructed its contractors to provide quarterly update reports 
to CMS on their progress in deactivating deceased physician UPINs, 
these efforts do not appear to have been successful. 

In 2004, HHS/OIG suggested that CMS conduct post-payment 
reviews to ensure that the measures taken in 2002 had successfully 
stopped the payment of deceased physician claims. There is no 
evidence, however, that either CMS or its contractors performed any 
reviews to test the effectiveness of the measures taken to prevent the 
payment of deceased physician claims. HHS/OIG also failed to conduct 
any audits to ensure the problem had been resolved. As a result of these 
oversight failures, seven years after the 200 1 HHS/OIG report and CMS 
efforts to resolve the problem, the Subcommittee found that Medicare 
continued to spend millions of dollars each year on improper claims 
containing identification numbers for deceased physicians. 
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V. CONCLUSION AND RECOMMENDATIONS 

The Subcommittee’s investigation has determined that, between 
2000 and 2007, Medicare paid between $60 million and $92 million for 
hundreds of thousands of DME claims that contained the UPINs of 
thousands of dead doctors. CMS had been notified of the problem as far 
back as 2001, and at that time, took steps to eliminate payments for 
claims containing deceased doctor UPINs. Based on the 
Subcommittee’s examination of the claims data, however, these 
measures were not fully implemented, and CMS, its contractors, and the 
HHS/OIG failed to conduct follow-up reviews to ensure that the 
problem had been resolved. The Subcommittee’s investigation did not 
attempt to identify when or how the breakdowns in implementation 
occurred. Whether the fault lies with the UPIN registry contractor, the 
claims processing contractors, CMS, or the HHS/OIG, the fact is that, 
seven years after the problem was first identified, the claims review 
process is still not working properly to reject claims containing the 
provider numbers of deceased physicians. 

The replacement of the UPIN registry with the new NPIs presents 
a fresh opportunity for the Medicare program to adopt new safeguards to 
stop the improper payment of claims containing deceased physician 
identification numbers. Better measures are needed to ensure that the 
NPI registry incorporates deceased physician information on a timely 
and effective basis and promptly deactivates appropriate NPIs. Better 
measures are also needed to ensure that claims containing deceased 
physician NPIs are automatically rejected and that payment is denied. 

Unless new procedures are put into place to better identify and 
deactivate the NPIs of deceased service providers, NPIs - like UPINs - 
will be used to obtain payments for services allegedly performed long 
after the cited service provider has died. Without new safeguards, the 
Medicare program will continue to be susceptible to fraudulent claims 
using invalid identification numbers. CMS should take action now, 
while it is implementing new procedures and rules, to ensure that NPI 
numbers are managed effectively, are deactivated promptly after a 
service provider’s death, and trigger the automatic rejection of any 
Medicare claim submitted after a specified time period following the 
date on which the service provider died. 

The Subcommittee staff accordingly recommends the following 
measures to resolve the ongoing problem of Medicare’s paying claims 
alleging services performed by deceased physicians. 

1. Strengthen Procedures to Deactivate NPIs after Physician 
Death. CMS should examine its procedures for identifying 
deceased physicians to ensure timely receipt of deceased 
physician data, automatic deactivation of relevant NPI numbers, 
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and continual update of the NPI registry. CMS should develop 
a quality control program to ensure NPIs are deactivated within 
a specified period of time after receiving notice of a physician’s 
death, such as 90 days. 

2. Initiate Regular NPI Registry and Claim Audits. CMS 

should initiate periodic audits of its NPI registry to test whether 
NPI numbers assigned to deceased physicians have been 
deactivated within the specified timeframe and to test Medicare 
payment records to determine whether claims containing 
deceased physician NPIs were rejected. 

3. Consider Additional Procedures and Audits to Strengthen 
NPI Registry. CMS should consider instituting additional 
procedures and audits to ensure the prompt deactivation of NPIs 
assigned to Medicare service providers who have stopped 
providing services due to licensure revocation, retirement, or 
other reasons, including automatic deactivation of any NPI that 
has not been used in a Medicare claim within a specified time 
period, such as 12 months. Consideration should also be given 
to developing procedures to allow deactivated NPIs to be 
reinstated upon proper application. 

♦ ♦ ♦ 
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APPENDIX I: SCOPE AND METHODOLOGY 

Random Sample Using American Medical Association TAMA) Data 

The Subcommittee requested information from the AMA. 
According to AMA officials, the “Master List” contains information on 
medical providers in the United States from the date they enter medical 
school until they die. The Subcommittee received a list of physicians 
whose dates of death were between 1992 and 2002. From the list of 
more than 53,000 physicians who had died during that timeframe, the 
Subcommittee identified more than 33,000 who had UPINs assigned. 

The Subcommittee then selected a statistically valid random 
sample of 1,500 physicians from the population of 33,000 deceased 
physicians with assigned UPINs. The 1,500 UPINs (4.5 percent) 
selected were forwarded to CMS to obtain data on any claims filed with 
those UPINs that had dates of service between January 1, 2000, and 
December 31, 2007. 

Florida Claims Data 

During a review of Medicare DME claims data provided by CMS, 
the Subcommittee discovered claims with dates of service between 2001 
and 2006 that were paid notwithstanding UPINs linked to deceased 
physicians. Based on this discovery, the Subcommittee obtained 
additional data from the Florida Department of Health for 1,086 
physicians whose license status reflected that they were deceased. Some 
of the physicians listed as deceased in the Florida Department of 
Health’s database did not list dates indicating when the license statuses 
were changed. To conduct its examination, the Subcommittee limited its 
review to include only those records that indicated a date of death before 
January 1, 2006. The Subcommittee did not consider any record without 
a date in the license status change date field or with a date after January 
1, 2006. The Subcommittee determined that, of the 648 physicians that 
met the criteria, 176 still had active UPINs as of March 25, 2008, despite 
the fact that the status was changed in the Florida Department of 
Health’s database to reflect dates of death between 1999 and 2006. The 
176 UPINs were submitted to CMS to obtain data for any claims paid 
containing these UPINs with dates of service between January 1 , 2000, 
and December 31, 2007. The data subsequently provided by CMS was 
then reviewed to identify those claims that were paid more than 12 
months after the physician’s license status was changed to reflect they 
were “deceased.” 

The Subcommittee also considered that there may have been 
outstanding orders for DME items that continued after the prescribing 
physician’s death. For example, HHS/OIG commented that wheel 
chairs, hospital beds, and other medical equipment can be rented for up 
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to 15 consecutive months, and this timeframe may extend beyond the 
date of the physician’s death. However, during the Subcommittee’s 
review, only those claims that were filed for dates of service at least 12 
months after the physicians’ deaths were considered. 
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APPENDIX II: CMS QUESTIONS AND RESPONSES 

On May 28, 2008, in light of its findings regarding claims 
containing UPINs assigned to deceased physicians, the Subcommittee 
submitted several questions to CMS. CMS provided written responses 
to the Subcommittee questions on June 4, 2008. The Subcommittee’s 
questions and the responses received from CMS are reprinted below. 

1. What processes and policies was Mr. Scully [CMS 
Administrator] referring to in his response [to the HHS/OIG 
report] that were to be implemented on April 1, 2002, that 
would cause any claim containing a deceased doctor’s UPIN to 
be rejected? 

CMS Response: 

CMS issued Change Request (CR) 2042, effective April 2002, that 
instructed the Common Working File (CWF) to reject DMEPOS claims 
using deceased physicians’ UPINs when the date of service exceeds (i.e., 
is later than) the physician’s date of death. This CR provided that the 
DME contractors must deny claims with an invalid or deceased ordering 
or referring physician’s UPIN on claims when the date of service 
exceeds the physician’s date of death. 

2. What other efforts as discussed in the [response] letter were 
taken to ensure UPINs were inactivated as indicated? 

CMS Response: 

CMS released a program memorandum AB-02-1 in September 
2002 that instructed contractors to educate and train providers (via 
newsletters and bulletins) about their responsibility to ensure that 
accurate UPINs are used on claims and that surrogate UPINs should not 
be used if ordering physicians have permanent UPINs. The effective 
date was October 1, 2002. 

In addition, as part of the UPIN process, National Heritage 
Insurance Company (NHIC) (the contractor that maintains the UPIN 
Registry) subcontracted with the AMA to provide a physician data file, 
which NHIC used to validate the data submitted by contractors. 
Biweekly, the AMA submitted a data extract file which contained 
physicians’ Date of Death. Contractor records submitted to the Registry 
were compared to the AMA physician death extract file. If, after the 
comparison, a physician was identified as deceased, an exception or 
notification was generated. Contractors were notified to update their 
physician records. On a monthly basis, contractors were sent a deceased 
physician notification list. If physician records were not updated over a 
period of time, the Registry would update or flag deceased physician 
records. 
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3. Are UPINs a required element of a claim and when was that 
requirement implemented? Since the Subcommittee is 
concerned only with data after January 2000, were UPINs 
mandatory at that point and did they ever become optional 
after January 2000? 

CMS Response: 

The effective date for requiring the UPIN of the ordering/referring 
physician for all services was January 1, 1992. As required by section 
1833(q) of the Social Security Act, all claims for Medicare covered 
services and items that are the result of a physician’s order or referral 
must include the ordering/referring physician’s name and UPIN. This 
includes parenteral and enteral nutrition, immunosuppressive drug 
claims, diagnostic laboratory services, diagnostic radiology services, 
consultative services, and durable medical equipment. Claims for other 
ordered/referred services not included in the preceding list must also 
show the ordering/referring physician’s name and UPIN. All physicians 
who order or refer Medicare beneficiaries or services must obtain a 
UPIN even though they may never bill Medicare directly. A physician 
who has not been assigned a UPIN must contact the Medicare carrier. 
During CMS’s NPI contingency period (October 1, 2006 - May 23, 
2008), the use of the UPIN became optional when the National Provider 
Identifier (NPI) became an alternative option. As of May 23, 2008, only 
an NPI is permitted on the claim and the UPIN (and other legacy 
numbers) may not be reported on the claim. 

CMS provided our contractors instructions in Publication 100-8, 
Chapter 14.6.1(A) CWF Edits and Claims Processing Requirements 
regarding UPIN reporting on Medicare claims. The following is an 
excerpt from the manual. 

If any procedure codes (HCPCS) associated in your claims 
processing system with CWF Type of Service (TOS) codes: 3 
(consultative services), 4 (diagnostic radiology), 5 
(diagnostic laboratory) (field 59, position 247 of the CWF 
Part B record) or durable medical equipment, orthotics and 
prosthetics, are shown on the claim form, the name of the 
physician who ordered or referred the item or service must be 
shown in Item 17. The ordering/referring physician’s 
assigned or surrogate UPIN is to be entered in Item 17a of 
Form CMS-1500. The first position of the UPIN must 
always be alpha, the second and third positions must be either 
alpha or numeric and the last 3 positions must be numeric. 

For electronic claims, enter the name and UPIN in 
Record/Field, EAO-20.0, positions 80-94 of the Electronic 
Media Claims format. Only the 6-digit base number of the 
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UPIN will be required for CWF edits for referring and 

ordering. Do not use the 4-digit location identifier. 

The following guidelines apply to those services that are 

edited by CWF: 

• If the service is a diagnostic laboratory or radiology 
service, the assigned UPIN of the ordering/referring 
physician must be shown in item 17a on Form CMS-1500; 

• If the performing physician is also the ordering physician, 
the physician must enter his/her name and UPIN in items 
17 and 17a of Form CMS-1500, confirming that the 
service is not the result of a referral from another 
physician; 

• If the ordering/referring physician is not assigned a UPIN, 
the biller may use OTHOOO until a UPIN is assigned, or a 
surrogate may be used (See section 14.6.2) 

• If the service is a consultative service, the name and UPIN 
of the referring physician or other person meeting the 
statutory definition of a physician must be shown on Form 
CMS-1500 in items 17 and 17a; 

• If the service was referred by other limited licensed 
practitioner, the name and UPIN of the physician 
supervising the limited licensed practitioner must be 
shown on Form CMS-1500 in items 17 and 17a; 

• If the service was the result of a referral from a person not 
meeting the statutory definition of a physician or a limited 
licensed practitioner (for example, a pharmacist, 
psychologist), the billing physician must enter his or her 
name and UPIN in items 17 and 17a, i.e., the physician 
completes Form CMS-1500 as though the service was 
initiated by the patient; and 

• If durable medical equipment, prosthetics and orthotics are 
ordered, the name and UPIN of the ordering physician 
must be on Form CMS-! 500 in items 17 and 17a. 

4. Does the claims review process, automated and manual, 

validate UPINs that are submitted on claims? 

CMS Response: 

The claims processing system confirmed the existence of a UPIN 
and validated that number as to proper form. If a UPIN was not 
provided on the claim form or an entry was not in proper form, the 
contractors (including DME contractors) would reject the claim and 
return it as unprocessable to the provider or supplier for correction. As 
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of May 23, 2008, UPINs may no longer be submitted on Medicare 
claims. The NPI is used in secondary identifier fields. 

CMS provided our contractors instructions in Publication 100-8, 
Chapter 14.6.1 (B) - CWF Edits and Claims Processing Requirements 
regarding the review and validation of UPIN reporting. The following is 
an excerpt from the manual. 

Deny, return or reject assigned claims requiring, but not 
containing, the name and UPIN of the 
ordering/referring physician depending on your 
system's capability and the cost effectiveness of the 
three options. If the claim is denied, afford the claimant 
the opportunity to appeal. Develop unassigned claims 
requiring a UPIN. 

In addition, CMS released a program memorandum 
AB-02-1 in September 2002 that instructed contractors 
to educate and train providers (via newsletters and 
bulletins) about their responsibility to ensure that 
accurate UPINs are used on claims and that surrogate 
UPINs should not be used if ordering physicians have 
permanent UPINs. The effective date was October 1, 

2002. 

5. What happens to a UPIN once CMS or a carrier/contractor is 
notified of a doctor’s death? Is there an automated process 
used to inactivate a UPIN under these circumstances? 

CMS Response: 

As of April 2002, CWF rejects DMEPOS claims using deceased 
physicians' UPINs when the date of service exceeds the physicians’ 
dates of death. The file containing the deceased physicians’ UPINs was 
updated every 1 5 months. The claims processing contractor would deny 
claims with an invalid or deceased ordering or referring physician’s 
UPIN on claims with dates of service that exceed the physician’s date of 
death. 

Yes, there is an automated process to alert contractors about 
deceased physicians. CMS provided contractor instructions in 
Publication 100-8, Chapter 14.4 - Automatic Notifications regarding 
how to handle deceased physician notifications. The following is an 
excerpt from the manual. 

The Registry alerts you if a record on the MPIER requires 
investigation and research. Notifications are sent through the Registry 
telecommunication system to your output file as Record Code 7. The 
Notification Code is displayed in Field 37 as an alpha code. Confirm 
and verify your file to determine if the notifications and records you 
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submitted are valid. Act on all automatic notifications (except code X - 
recision/denial) within 30 calendar days. The conditions for which the 
Registry sends you notification are: 

Deceased Physician/Health Care Practitioner-Notification 
Code D 

Verily information regarding the alleged death of a 
physician/health care practitioner with the State Licensure 
Board, Medical Trade Association, or other outside entity. 

If the physician/health care practitioner is deceased, 
generate an update record for each practice setting using 
Record Code 5 and update Field 20, “Date of Death,” with 
the appropriate dates, and Field 29, “DRIP,” with a “D” 
for deactivate for every practice setting. 

If the physician/health care practitioner is not deceased, 
notify the Registry via a letter or TMAIL. Identify the 
source of your information. 
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APPENDIX III: CMS RESPONSE TO REPORT FINDINGS 



DEPARTMENT OF 1 1EALTH & HUMAN SERVICES 


JUN 2 4 2008 


Centers for Medicare & Medicaid Services 


Deputy Administrator 
Baltimore, MD 21244-1850 


TO: 


FROM: 


SUBJECT: 


Thank you tor 

Investigations’ findings that Medicare is continuing to pay claims to providers who are using 
invalid or inactive physician numbers. The Centers for Medicare & Medicaid Services (CMS) 
appreciates the time and resources that the Subcommittee has invested in this study and shares 
your concerns. CMS has already taken several steps to implement changes to its policies and 
procedures so this type of activity does not continue to occur. 

On January 25. 2008, CMS published in the Federal Register a proposed rule titled, “Medicare 
Program; Establishing Additional Medicare Durable Medical Equipment, Prothetics, Orthotics, 
and Supplies (DMEPOS) Supplier Enrollment Safeguards’’(CMS-6036-P). In this proposed rule, 
CMS proposed requiring DMEPOS suppliers to maintain ordering and referring documentation 
received from a physician or other non-physician practitioner (e.g., nurse practitioner, physician 
assistant, etc.) for seven years. CMS believes that this change, if adopted, will strengthen our 
ability to identify fraudulent billing during documentation reviews. CMS is currently reviewing 
public comments received on this proposed rule. In addition, we arc considering whether it is 
necessary to propose regulations requiring that physicians and nonphysician practitioners 
maintain documentation when ordering or referring services for Medicare patients. 

Additionally, CMS is developing a data matching agreement with the Social Security 
Administration (SSA) which will provide CMS with monthly updates of the SSA Date of Death 
file. CMS will then match this information with information contained in the National Plan and 
Provider Enumeration System, the system that maintains information about National Provider 
Identifiers (NP1), and our provider enrollment database, the Provider Enrollment, Chain and 
Ownership System. After confirming the individual practitioner is deceased, CMS will 
deactivate both the NP1 and the practitioner’s enrollment in the Medicare program. We expect to 
have the data matching agreement and this new process implemented later this year. 

Finally, while our current claims processing system allows an individual or organization NPI to 
be used for the purposes of ordering and referring services to Medicare beneficiaries, we 
anticipate implementing changes in 2009 that will limit ordering and referring to individual 
practitioners enrolled in the Medicare program. 

CMS would like to again acknowledge our appreciation to the Permanent Subcommittee on 
Investigations for its efforts and appreciates the opportunity to review and comment on the 
Subcommittee’s investigative findings. We believe the initiatives we have initiated will address 
many - if not all - of the issues surrounding the payments for claims to those health care 
providers who are using either invalid or inactive physician numbers. In this regard, we look 
forward to any additional insights the Subcommittee can provide to further assist us in 
strengthening our stewardship of the Medicare Trust Funds. 


Chairman Carl Levin 
Ranking Member Norm Coleman 
Permanent Subcommittee on Investigations 
Committee on Homeland Security and Governmental Affairs 
United Stales Senate 

Herb Kuhn 
Deputy Administrator 
Centers for Medicare & Medicaid 

Investigative Findings Regarding Medicare Payments to Providers Who Are 
Using Invalid or Inactive Physician Numbers 


the opportunity to review and comment on the Permanent Subcommittee on 
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U. S. SENATE 

PERMANENT SUBCOMMITTEE ON INVESTIGATIONS 
MINORITY STAFF REPORT 
ON 

MEDICARE VULNERABILITIES: 

THE USE OF DIAGNOSIS CODES IN DME CLAIMS 


I. INTRODUCTION 

The Medicare program was established to provide health insurance 
for the elderly and the disabled. In 2007, Medicare paid more than $400 
billion to cover more than 43 million beneficiaries. 1 Despite its noble 
intentions, the Medicare program has faced a pervasive and persistent 
problem with fraud, waste, and abuse. For instance, the Government 
Accountability Office (GAO) has designated the Medicare program as 
high risk, due to its size, complexity, and vulnerability to 
mismanagement and improper payments, for every year since 1990. 2 In 
its fiscal year 2005 performance and accountability report, the 
Department of Health and Human Services (HHS) reported that it paid 
an estimated $12.1 billion in improper payments for Medicare claims in 
that year alone. 3 The improper payments for fiscal year 2004 were even 
larger, amounting to an estimated $21.7 billion. 4 5 

Medicare Part B, the component in which Medicare pays for 
certain durable medical equipment and supplies (commonly called DME 
or DMEPOS), is particularly susceptible to abuse. According to the 
Centers for Medicare and Medicaid Services (CMS), the Federal agency 
that administers the Medicare program, abuses related to DME claims 
cost billions of dollars each year. 3 On March 8, 2007, CMS’s Chief 
Financial Officer testified before a Congressional committee, “[t]he 
fraudulent business practices of unscrupulous durable medical 
equipment, prosthetics, orthotics, and supplies suppliers continue to cost 
the Medicare program billions of dollars.” 6 In 2007, GAO reported that 


1 See 2008 Annual Report of the Boards of Trustees of the Federal Hospital Insurance and 
Federal Supplementary Medical Insurance Trust Funds, at pg. 2. 

2 See GAO-07-3 1 0, High-Risk Series: An Update, January 2007. 

3 See U.S. Department of Health and Human Services, Fiscal Year 2005 Performance and 
Accountability Report, at pg. IV.C.8. 

4 See id. 

5 The Centers for Medicare and Medicaid Services was formerly called the Health Care 
Financing Administration (HCFA), until the entity was redesignated in 2001 . 

6 See Testimony of CMS Chief Financial Officer Timothy B. Hill before the House Ways and 
Means Subcommittees on Health and Oversight, March 8, 2007. 
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CMS estimated that Medicare made improper payments based on 
mistakes, abuse, or fraud totaling approximately $700 million for DME 
supplies in a single year. According to GAO, these types of payments 
represented approximately 7.5 percent of its total payments for DME 
items. 7 

In light of reports of waste and abuse in the Medicare program, the 
U.S. Senate Permanent Subcommittee on Investigations (the Sub- 
committee) initiated an investigation into fraud, waste, and abuse in the 
Medicare program, with a particular focus on the diagnosis codes on 
DME claims. The Subcommittee’s inquiry also examined the 
effectiveness of CMS’s use of the codes. 

Over the course of its investigation, Subcommittee staff examined 
extensive data concerning millions of DME claims submitted between 
1995 and 2006. The Subcommittee also interviewed numerous officials 
from CMS, Medicare contractors, the Department of Justice Fraud 
Division, investigators from the Department of Health and Human 
Services Office of the Inspector General (HHS/OIG), as well as 
physicians, representatives of DME suppliers, and Medicare 
beneficiaries. In conjunction with that investigation, the Subcommittee 
held a hearing and released a bipartisan staff report on July 9, 2008, 
entitled Medicare Vulnerabilities: Payments for Claims Tied to 
Deceased Doctors , 8 That report estimated that, from 2000 through 
2007, Medicare had paid up to $100 million for DME claims containing 
identification numbers assigned to doctors who had died between one 
and fifteen years before the claims. 

In addition to its review of DME claims tied to deceased 
physicians, the Subcommittee examined the use of diagnosis codes 
associated with DME claims. This Report presents the Subcommittee 
staffs findings and Minority staffs recommendations with respect to 
that analysis. 

II. EXECUTIVE SUMMARY 

This Report examines several aspects of the Medicare DME 
benefit, with a particular focus on the requirement for and use of 
diagnosis codes. Diagnosis codes are the numeric or alphanumeric 
designations on a Medicare DME claim that identify the beneficiary’s 
ailment. The Subcommittee’s investigation found that the laws 
governing the use of diagnosis codes on most DME claims have been 


7 See GAO 07-59, Medicare: Improvements Needed to Address Improper Payments for 
Medical Equipment and Supplies, January 31, 2007. 

8 See U.S. Senate Permanent Subcommittee on Investigations, Medicare Vulnerabilities: 
Payments for Claims Tied to Deceased Doctors (July 9, 2008). 
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inconsistent from 1991 through 2003, including certain rules that appear 
contradictory. The Health Insurance Portability and Accountability Act 
of 1996 (HIPAA) mandated the establishment and use of standardized 
codes (contained in the International Classification of Diseases, Ninth 
Revision, with Clinical Modification (ICD-9-CM)) on claims and CMS 
issued a regulation consistent with this requirement, which became 
effective in 2003. 

Although diagnosis codes have been required on most DME claims 
since at least 2003, the Subcommittee found that CMS and its claims 
review contractors are not effectively utilizing the codes. For example, 
the Medicare claims review process examines claims to ensure that valid 
diagnosis codes are present, but does not review the claims to determine 
whether the diagnoses are remotely related to the purchased medical 
equipment. In short, the Subcommittee’s investigation found that the 
diagnosis code requirement appears to be a mandate with little 
substantive purpose. 

The Subcommittee examined data related to millions of DME 
claims in order to determine whether diagnosis codes submitted on 
claims could be utilized for beneficial purposes, including to identify 
questionable or improper payments and hence augment Medicare’s 
efforts to uncover fraud, waste, and abuse. The Subcommittee’s analysis 
of these claims identified many instances in which examining the 
diagnosis codes on DME claims could be a valuable tool to uncover 
fraudulent or abusive claims. For instance, the Subcommittee uncovered 
numerous claims in which the diagnosis code section contained a valid 
ICD-9-CM code, but the diagnosis appeared highly questionable and 
unrelated to the purchased medical equipment. For example, the 
Subcommittee reviewed hundreds of thousands of claims paid by 
Medicare for blood glucose test strips, which are used by diabetics to 
test their blood-sugar levels, and found that many contained 
questionable diagnoses that appear wholly unrelated to diabetes. The 
Subcommittee also uncovered hundreds of thousands of claims for blood 
glucose test strips in which the stated diagnosis was chronic airway 
obstruction, bubonic plague, leprosy, typhoid, or cholera. Experts 
interviewed by the Subcommittee - including representatives of the 
Centers for Disease Control and Prevention, a prominent manufacturer 
of blood glucose strips, and a well-known medical school - universally 
confirmed that such diagnoses were not appropriate for that product. 
The Subcommittee’s analysis of blood glucose test strips and 17 other 
DME items found millions of claims that contained questionable 
diagnosis codes totaling more than $1 billion. 

The Subcommittee also examined claims data from 1995 through 
2006 related to $4.8 billion in Medicare payments for 60 million DME 
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items that contained diagnosis codes that were invalid, blank, or 
unprocessable. To analyze these claims, the Subcommittee conducted a 
detailed examination of a subset of 2,000 claim submissions. The 
Subcommittee could not verify more than 30 percent of the 2,000 claims 
as legitimate and found during the detailed review that other elements of 
the claim bore certain characteristics of fraudulent activity. Numerous 
claims, for instance, contained the identification number of a doctor who 
had died years before the service dates on the claims. For hundreds of 
other items, the doctors identified on the claims denied that they had 
prescribed those items, or even that they had treated those patients. 

Notably, while not every instance of an invalid or questionable 
diagnosis code found during the Subcommittee’s review necessarily 
reflects an improper payment, and while the number of claims with 
invalid diagnosis codes decreased significantly after the implementation 
of HIPAA in 2003, Medicare’s history of weaknesses in its payment 
processes suggest that additional procedures are needed to ensure that 
payments are accurate and in compliance with program rules. 9 The 
Subcommittee’s analysis suggests that incoiporating system edits that 
would deny claims or flag them for medical review or follow-up, or 
otherwise performing analysis of diagnosis codes could be a useful tool 
in uncovering questionable DME claims, preventing fraud, waste, and 
abuse, and reducing improper payments. In fact, Congress contemplated 
the use of diagnosis codes for “prepayment screens” as far back as 
1988. 10 The Subcommittee’s findings propose that analyzing the 
diagnosis codes on claim submissions could be an effective control 
mechanism to assist Medicare’s efforts to reduce improper payments. 

A. Report Findings 

Based on its investigation, the Subcommittee staff makes the 
following findings: 

1. Rules Governing the Use of Diagnosis Codes on DME 
Claims from Suppliers Have Been Inconsistent. Between 
1991 and 2003, the laws and regulations governing the 
submission of diagnosis codes on claims from DME suppliers 
have been inconsistent and, in some cases, appear contradictory. 
Moreover, although diagnosis 


9 The Subcommittee’s review of the claims data revealed that Medicare continued to pay DME 
suppliers for claims that contained invalid diagnosis codes after the 2003 implementation of 
HIPAA. However, the volume and amount of these claims decreased after 2003, with 
Subcommittee analysis showing that Medicare paid more than $23 million for DME claims 
that contained invalid diagnosis codes. 

10 See 54 FR 30558, Medicare Program; Diagnosis Codes on Physician Bills (July 21, 1989). 
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codes have been required since the implementation of HIPAA in 
2003, CMS’s application of the diagnosis code requirement is 
inconsistent, potentially resulting in the payment of some items 
tied to invalid diagnosis codes and the rejection of claims that 
contain valid diagnosis codes. 

2, Medicare Has Not Used Diagnosis Codes Effectively in the 
Claims Review Process. Although diagnosis codes have been 
required for DME supplier claims since at least 2003, Medicare 
generally does not use the codes to assist in determining the 
validity or medical necessity of the claims. In paying the 
claims, CMS’s utilization of the codes is largely limited to 
verifying the presence of a valid code. 

3. Some Data Related to Millions of Claims Was Incorrect and 
Outdated. Over the course of its investigation, the 
Subcommittee learned that some claims records contained 
incorrect and outdated information. Although the source of the 
flawed data is unclear, that data caused certain diagnosis codes 
to be described as invalid, when in fact, they were valid. This 
caused an overstatement of claims with invalid diagnosis codes 
of more than $1.4 billion. 

In its communications with the Subcommittee, CMS officials 
stated that CMS is currently undergoing substantial changes in the way 
Medicare claims are processed. According to the officials, many 
changes that directly affect Medicare claims are in progress, such as 
changes to physician and DME supplier identification numbers. 11 The 
officials assert that these modifications will make the claims process 
more standardized among the claims processing contractors. 12 

B. Report Recommendations 

Based upon the Subcommittee’s investigation and the ongoing 
reform of the Medicare claims review processes, the Subcommittee 
minority staff makes the following recommendations: 

I. Strengthen Claims Review Process. CMS should consider 
strengthening the claims review process by more effectively 
utilizing all diagnosis codes submitted on claims. All diagnosis 
codes entered onto a claim should be valid and medically relate 
to the supplied DME items. Claims with any invalid or 
incorrect codes should be rejected and returned to the biller for 
correction. 


11 See 45 CFR Part 162, Federal Register, Vol. 69, No. 15, January 23, 2004, at pg. 3434. 

12 Subcommittee interview of CMS officials, January 10, 2008. 


5 



120 


2. Consider Developing Procedures to Link Diagnosis Codes 
with Medical Procedures. CMS should consider developing 
processes that use the diagnosis codes to prevent, detect, and 
reject improper payments. This could include creating 
procedures to link ICD-9-CM diagnosis codes included on 
DME claims with authorized medical procedures (HCPCS), 
similar to what is already being performed by some contractors 
on select DME items. 

3. Consider Developing Procedures to Link Claims for DME 
Items with a Corresponding Claim for Medical Treatment. 

CMS should consider incorporating an edit into the claims 
processing system that would check a claim for a DME item 
against a claim for a doctor visit that would have resulted in an 
order or prescription for the item, similar to what is already 
being performed on DME claims for select items. Furthermore, 
for DME claims that do not have a corresponding medical 
treatment claims, CMS should consider performing additional 
procedures in order to ensure the medical necessity and integrity 
of the claims. 

4. Strengthen Contractor Oversight. CMS should consider 
strengthening its contractor oversight, including contractor 
penalties for making improper payments or maintaining 
unreliable data. 

III. BACKGROUND 

This Report examines certain aspects of the Medicare claims 
process in general and the durable medical equipment benefit in 
particular. In exploring these issues, several central concepts, terms, and 
entities warrant some background and context, which is presented 
below. 

A. Overview of Medicare and Claims for Durable 
Medical Equipment Under Part B 

1. Medicare and DME in General 

Title XVIII of the Social Security Act (SSA), entitled “Health 
Insurance for the Aged and Disabled,” established the Medicare program 
in 1965. 13 Medicare was created to provide health insurance for the 
aged, disabled, and persons with end-stage renal disease. The program 
is administered by the HHS through CMS. 


13 Title XVIII appears in the United States Code at 42 U.S.C. §§ 1395-1395(ccc). 
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Medicare is comprised of four parts. Part A, the Hospital 
Insurance Program, covers hospital services, post-hospital services, and 
hospice services. Part B, the Supplementary Medical Insurance 
Program, covers medical services including physician, laboratory, 
outpatient services, and DME. Part C covers managed care options for 
beneficiaries enrolled in Part A and Part B. Part D, created by the 
Medicare Prescription Drug Improvement and Modernization Act of 
2003, covers outpatient prescription drug benefits as of January 1, 
2006. 14 

Under Part B, the Medicare program will pay for certain DME for 
eligible Medicare beneficiaries under the DMEPOS benefit. 15 The term 
DME refers to medical equipment and supplies that are used in the 
patient’s home (including an institution such as a nursing home in which 
the patient resides). 16 Medicare regulations define DME as: 

[EJquipment furnished by a supplier or a home health agency 

that: 

( 1 ) Can withstand repeated use; 

(2) Is primarily and customarily used to serve a 
medical purpose; 

(3) Generally is not useful to an individual in the 
absence of an illness or injury; and 

(4) Is appropriate for use in the home. 17 

Examples of DME include wheelchairs, oxygen concentrators, 
nebulizers, canes, hospital beds, and diabetic equipment and supplies, 
such as blood glucose test strips. 

2. DME Claims and Suppliers 

The Medicare claims process for DME typically involves three 
parties: (1) the Medicare beneficiary, who is a patient eligible for 
Medicare that needs certain medical supplies or equipment; (2) the 
medical practitioner, such as a physician, nurse practitioner, physician 
assistant, clinical social worker or psychologist, who is treating the 
beneficiary and prescribing the equipment; and (3) the DME supplier, a 
private entity authorized by CMS to provide DME items to Medicare 
beneficiaries and bill Medicare directly. The process of a DME claim 
generally starts with the Medicare beneficiary receiving treatment from a 


14 Prior to this date, certain prescription drugs were covered under Medicare Part B. 

15 See SSA §1833(a)(l)(I). 

16 See SSA §1861(n). 

17 See 42 CFR 414.202. 
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medical practitioner. If the physician writes an order or prescription for 
DME, the beneficiary can take the prescription to a DME supplier of his 
or her choosing and the DME supplier sells or rents the prescribed item 
to the beneficiary. 18 

In most circumstances, the DME supplier then submits a claim for 
payment to an entity authorized by CMS to receive, review, and process 
Medicare claims. Durable Medical Equipment Regional Carrier 
(DMERC) or other Medicare carrier. 19 DMERCs were established to 
standardize the coverage and payment of DME claims and were 
designed to be the experts in the Medicare DME claims process. Their 
primary role was to accept and process Medicare Part B DME claims. 
In doing so, DMERCs were also expected to consolidate and focus 
efforts to combat fraud, waste, and abuse in the DME benefit program. 20 

Physicians generally file claims to Medicare that deal with 
treatment, office visits, and other medical procedures, while DME 
claims are typically submitted by suppliers. As noted above, DME 
suppliers are entities that are enrolled in the Medicare program to sell or 
rent durable medical equipment to eligible beneficiaries and submit 
claims for payment directly to Medicare. DME suppliers typically 
include pharmacies or companies that specialize in DME such as 
wheelchairs, oxygen supplies, diabetic supplies and other supplies and 
equipment that are provided to Medicare beneficiaries, as well as other 
medical patients. 

3. DME Must Be “Medically Necessary” 

In creating Medicare, the Social Security Act provides that only 
items and services that are medically necessary will be covered. Section 
1862 (a)(1)(A) of the Social Security Act states: “[N]o payment may be 
made under Part A or Part B for any expenses incurred for items or 


18 For certain DME, including equipment that is expensive and prone to fraudulent activity, 
CMS regulations require the physician to provide a Certificate of Medical Necessity (CMN) 
in addition to a prescription. For instance, Medicare requires a CMN for oxygen or infusion 
pumps. A CMN is a form required to help document the medical necessity and other 
coverage criteria for selected DMEPOS. See Medicare Claims Processing Manual, Chapter 
20, Section 100.2, 

19 DME Medicare Administrative Contractors (DME MACs) replaced the DMERCS beginning 
in January 2006 to comply with Medicare Modernization Act of 2003, which amended 42 
U.S.C. Section 1874A, The DME MACS are now responsible for administering tile 
Medicare Part B DME Claims. DMERCS were the claims processing contractors for all 
claims reviewed for this report. 

20 Section 91 1 of the Medicare Modernization Act of 2003, known as the Medicare Contracting 
Reform provision, required CMS to compete ail currently held contracts for administration of 
the Medicare fee-for service program. The new contractors selected through these 
competitions are called Medicare Administrative Contractors (MACs). DME MACs are the 
new contractors for DME services. 
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services which are not reasonable and necessary for the diagnosis or 
treatment of illness or injury or to improve the functioning of a 
malformed body member.” 

CMS has referenced the medical necessity requirement frequently 
in its regulations, publications, and notices sent to DME suppliers and 
contractors. For instance, in a 2002 Program Memorandum sent to 
Medicare carriers, CMS stated, “Medicare pays for DMEPOS when it is 
medically necessary for use in a patient’s home.” 21 Similarly, the 
Medicare Program General Information section of CMS’s website 
emphasizes that Part B of Medicare (which includes DME claims) 
covers only medically necessary items and services: “Part B helps pay 
for these covered services and supplies when they are medically 
necessary.” 22 

CMS also uses the term in its Medicare Claims Processing Manual. 
For instance, Chapter 20, Section 10.2 of the manual contains a table 
that delineates the conditions that must be met before a DME claim will 
be paid; the first requirement in the table is that the DME must be 
medically necessary. 23 Medicare carriers, the contractors retained by 
CMS to administer many functions of the program, have also 
emphasized the requirement that claims for DME be medically 
necessary in notices they have published for the providers within their 
jurisdictions. 24 More recently, the Chief Financial Officer of CMS 
testified before the House of Representatives Committee on the Budget 
in July 2007 and reiterated the medical necessity requirement established 
in the Social Security Act, stating “Medicare contractors review claims 
submitted by providers to ensure payment is made only for Medicare- 


21 See CMS Program Memorandum - Carriers, Transmittal B-02-087, Change Request 2453, 
November 8, 2002. 

21 See http://www.cms.hhs.gov/MedicareGenInfo/; see also 

http://www.cms.hhs.gOv/MedicareGenInfo/03_Part%20B.asp#TopOfPage, 

23 See Medicare Claims Processing Manual, Chapter 20, Section 10.2. 

24 See http://www.palmettogba.com/palmetto/providers.nsf/(Docs)/296333A85C1581A285257 
33 1 0065FDC7?OpenDocument; http://www.cignagovemmentservices.com/jc/pubs/pdf/ 
2007_winter/2007_winter_SM.pdf; https://www.noridianmedicare.com/dme/news/bulletins/ 
dmercdialogue/winter_2005/winter05_dd.pdf. 
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covered items and services that are reasonable and necessary and 
furnished to eligible individuals.”' 5 

The failure to establish the medical necessity requirement has been 
a substantial problem in the Medicare program, according to previous 
annual reports issued by the HHS/OIG. The HHS/OIG analyzed 
Medicare claims filed over the four-year period between 1996 and 1999 
and found that the failures to establish the medical necessity of the DME 
supplies and other errors “have been and continue to be pervasive 
problems.” 26 The OIG reported that documentation errors and the 
failure to establish medical necessity accounted for more than 70 percent 
of the total improper payments over the four-year timeframe. 

The HHS/OIG’s analysis of claims filed in 1999 with respect to the 
medical necessity requirement is particularly noteworthy. The 
HHS/OIG conducted an in-depth audit of Medicare claims filed in 1999 
in order to determine whether Medicare fee-for-service payments were 
made in accordance with the Social Security Act and implementing 
regulations, including the medically necessity requirement. In the 
report, the HHS/OIG concluded that Medicare made improper payments 
totaling $13.5 billion in 1999 alone. Notably, the HHS/OIG found that 
more than 45 percent of the total improper payments in 1999 - meaning 
$4.4 billion - were for claims that lacked proof of medical necessity. 

4. International Classification of Diseases, Ninth 
Revision, with Clinical Modification (ICD-9-CM) 
Diagnosis Codes 

Medicare regulations require that claims must contain certain 
information in order to qualify for payment. Claims must include valid 
identification numbers for the beneficiary, medical provider, and DME 


25 See Testimony of Timothy B. Hill, CFO, Centers for Medicare and Medicaid Services before 
the House Budget Committee, Medicare Health Care Fraud and Abuse Efforts, July 17, 2007, 
https://www.hhs.gov/asl/testity/2007/07/t20070717b.html. Federal courts have also noted 
that claims under Medicare Part B must be medically necessary. The U.S. Supreme Court in 
Schweiker v. McClure described the Medicare Part B claims review process as follows: 
“Once the carrier has been billed for a particular service, it decides initially whether the 
services were medically necessary, whether the charges are reasonable, and whether the 
claim is otherwise covered by Part B.” 456 U.S. 188, 191, 102 S. Ct. 1665, 1667 (1982) 
(citing the Social Security Act). Although the facts of Schweiker involved a claim under Part 
B for medical services, rather than the DME claims that are at issue in this report, the 
requirement of medical necessity is identical. Like the Supreme Court in Schweiker . the 
United States Court of Appeals for the Eleventh Circuit explained in Gulfcoast Medical 
Supply. Inc, v. Secretary, Department of Health and Human Services that Part B Medicare 
coverage “extends to only those medical services that are medically ‘reasonable and 
necessary’ for the beneficiary.” 468 F.3d 1347 (1 1th Cir. 2006). 

26 See HHS/OIG, Improper Fiscal Year 1999 Medicare Fee-for-Service Payments , Number A- 
17-99-01999. 
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supplier. 27 Additionally, claims must contain certain codes or other 
information that describes the beneficiary’s diagnosis. 28 For instance, if 
a beneficiary needs a DME item, such as a wheelchair, the claim must 
include a diagnosis from a medical professional of the physical 
condition that indicates the wheelchair is reasonable and necessary. 
Current CMS regulations mandate that claims that do not have valid 
information - including a medical diagnosis - must be returned to the 
supplier for correction.' 9 

Medicare regulations have required that certain claims must reflect 
the patient’s diagnoses in a standardized numeric or alphanumeric 
code. 30 CMS has adopted the coding system called the International 
Classification of Diseases, Ninth Revision, with Clinical Modification, 
which is commonly referred to as the ICD-9-CM. CMS described and 
provided the history of the ICD-9-CM as follows: 

The International Classification of Diseases, Ninth Revision 
(ICD-9) is a classification system developed by the World 
Health Organization for recording morbidity and mortality 
information for statistical purposes, for indexing hospital 
records by diseases, and for storing and retrieving data. The 
clinical modification to ICD-9 (that is, ICD-9-CM) is a 
coding system for reporting diagnostic information and 
procedures performed on a patient in hospitals or connected 
with other types of health care delivery systems. 

ICD-9-CM was developed under the guidance of the National 
Center for Health Statistics (NCHS) to adapt the ICD-9 
classification system to the needs of hospitals in the United 
States. The modifications were intended to provide a 
mechanism to present a clinical picture of the patient. Thus, 
ICD-9-CM codes are more precise than those included in 
ICD-9 since greater precision is needed to describe the 
clinical picture of a patient than for statistical groupings and 
trend analysis. 


27 See Medicare Claims Processing Manual, Chapter 1, Section 80.3.1 through 80.3.2. 

28 See, e.g., 42 CFR 424.32 (requiring physicians to provide ICD-9-CM diagnosis code for all 
claims for services and items). 

29 See Medicare Claims Processing Manual, Chapter 1, Section 80.3.2. When a claim is valid, 
CMS regulations require that the claim be paid within thirty days. See Medicare Claims 
Processing Manual, Chapter 1, Section 80.2.1.1. Any claim that contains invalid data, 
however, is not considered received for purposes of the thirty-day prompt-payment rule. See 
Medicare Claims Processing Manual, Chapter 1 , Section 80.3.2. 
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Effective January 1979, after nearly two years of 
development by numerous national experts on clinical 
technical matters, the ICD-9-CM became the single 
classification system intended for use by hospitals in the 
United States. This system replaced several earlier related but 
somewhat dissimilar classification systems. ... 

The ICD-9-CM is a numeric and, in some circumstances, 
alphanumeric code that ranges from three to five digits and describes the 
clinical reason for a patient’s treatment. Examples of valid ICD-9-CM 
diagnosis codes are identified in Figure 1 below. 
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Figure 1 


B. Legislation and Regulations Governing 
DME Claims Under Medicare Part B 

Prior to 1989, only hospitals were required to include ICD-9-CM 
diagnosis codes in connection with Medicare claims. In 1989, HCFA 
implemented rules pursuant to the Medicare Catastrophic Coverage Act 
of 1988 (MCCA) that required that claims submitted by physicians for 
items or services contain a valid diagnosis code. 31 In the conference 


31 See Public Law 100-360, Section 202(g)(p)(l) (amending Social Security Act, 42 U.S.C. 
1395u), Jtily 1, 1988. A Senate version of the MCCA would have required that all 
prescriptions from physicians contain a valid diagnosis code, but the Conference Committee 
determined that requirement would be too burdensome on physicians. As a result, the 
Conference Committee agreed that only claims for services from physicians required a 
diagnosis code. See CR 100-661. The final language of the MCCA, however, still included 
the term “items”: “Each request for payment, or bill submitted, for an item or service 
furnished by a physician for which payment may be made under this part shall include the 
appropriate diagnosis code (or codes) as established by the Secretary for such item or 
service.” 
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report that accompanied the MCCA, the conferees explained their 
reasoning for requiring diagnostic coding for physician services under 
Part B as follows: “This information would be available for immediate 
use for utilization review of physician services (and could be used for 
prepayment screens)...” 32 In keeping with the use of ICD-9-CM codes 
for hospital claims, CMS determined that the appropriate codes for 
physician claims would be the ICD-9-CM as well. 3 Although DME 
claims submitted by hospitals and physicians were required to contain 
diagnosis codes, it is unclear when DME claims submitted by suppliers 
were required to include diagnosis codes. Below is a review of relevant 
laws and regulations that address the use of diagnosis codes for DME 
claims from suppliers. 

1. The 1991 Notice 

On November 29, 1991, HCFA published 56 FR 61023, a notice 
entitled “Medicare Program: Standard Claim Forms for Part B Claims 
Completed and Submitted by Physicians, Suppliers and Other Persons” 
(the 1991 Notice). Before the promulgation of this notice, DME 
suppliers had been allowed to attach supporting documents to their 
claims that contained relevant diagnosis information, such as medical 
records, narratives, or Certificates of Medical Necessity. The 1991 
Notice forbade the attachment of supplemental materials and required all 
claims to be uniform. The notice announced that, effective April 1, 
1992, Medicare would no longer accept so-called non-standard claims. 
The notice defined non-standard claims as claims accompanied by 
attachments in lieu of the biller entering the required information in the 
designated blocks of the prescribed claim forms. Additionally, the rule 
mandated that physician and supplies must submit claims on a specified 
form, the HCFA Form 1500. 34 

Effective April 1, 1992, Medicare carriers will no longer 
accept claim attachments for information that physicians and 
suppliers may enter in designated blocks of prescribed claim 
forms. Incomplete claim forms will be returned to the billing 
individual or entity for proper completion and resubmission. 

The claim submission requirement in section 1848(g)(4)(A) 
of the Act is not satisfied until a standard, prescribed claim 
form is properly completed and submitted by the physician, 


32 H.R. Rep. No. 661, 100th Cong., 2nd Sess. 191 (1988). 

33 See 54 FR 30558. 

33 The HCFA Form 1 500 is the standard claim form used by physicians and suppliers to file 
claims for treatment and equipment provided to Medicare beneficiaries. 
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supplier or authorized billing entity and received for 
processing by the servicing carrier, 35 

CMS explained in the notice that the change was necessary to 
eliminate costly and inefficient claim processing practices that were 
resulting from processing claims with attachments. CMS also justified 
the rule change by stating that non-standard claims (i) create additional 
administrative burdens on the carriers that process the claims, (ii) 
generate additional cost per claim, and (iii) slow the claim process down 
30 to 50 percent. CMS also explained that each of the carriers handled 
claims differently. 36 

Currently, we allow carriers to determine whether they will 
accept non-standard claims for processing. Some carriers 
accept only standard claims. Some accept non-standard 
claims, but may restrict which information is allowed to be 
included. Others accept non-standard claims without 
restrictions. 

The notice instructed physicians, suppliers, and other persons to 
stop submitting claims for DME with attachments when the information 
contained in the attachments could be entered into the appropriate blocks 
of the HCFA Form 1500. Notably, the HCFA Form 1500 contains 
blocks for up to four diagnosis codes. 

2. 1994 Final Rule from MCCA 

Roughly two years later, on March 4, 1994, HCFA published a rule 
that affected the submission of diagnosis claims in DME claims from 
suppliers. 37 This rule, which was adopted pursuant to the MCCA, 
amended the relevant Medicare regulations to require that all claims for 
items and services from physicians contain a valid ICD-9-CM diagnosis 
code. However, in promulgating the final rule, HCFA stated, “the 
proposed rule did not apply to suppliers or other providers whose 
services are covered under Part B.”’ 8 HCFA also responded to a 
comment submitted during the comment period on the proposed rule 
concerning the diagnosis code requirement. The commenter asserted 
that, even though most DME suppliers were already providing diagnosis 
codes with their claims, there should be no requirement for DME 
suppliers to provide diagnosis codes. Notably, despite the language of 
the 1991 Notice that required suppliers to use the Form 1500 and 


35 See 56 FR 61023. 

36 See id 

37 See 59 FR 10290, March 4, 1994, Medicare Program: Diagnosis Codes on Physician Bills. 

38 See id, Section III. Provisions of the Proposed Rule. 
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complete the field for diagnosis codes on that form, HCFA responded 
that it had never required DME suppliers to provide diagnosis codes. 39 
Figure 2 below presents the relevant section of the final rule. 


Comment : One commenter stated that suppliers cannot be required to include 
diagnostic coding on Part B bills even though they often provide the diagnostic 
codes identified by the physician on bills for equipment and supplies. 

Response: We have never required suppliers to include diagnostic coding on 
their Part B bills. Section 1842(p)(l) of the Act requires physicians, as defined 
in section 1 86 1 (r) of the Act, and subject to limitations concerning the scope of 
practice by each State and other provisions of title XVIII of the Act, to furnish 
diagnostic coding. That is, only doctors of medicine or osteopathy, dental 
surgery or dental medicine, podiatry, optometry, or chiropractic must furnish 
diagnostic coding. Durable medical equipment suppliers are not included in this 

requirement. 

Figure 2 


3. 1996 Bulletin 

In February 1 996, HCFA issued a bulletin to all of its providers - 
including DME suppliers - that articulated new rules regarding invalid 
and incomplete claims. Section 5.0 of the Provider Bulletin, entitled 
“Return/Reject Claims,” stated: 

The Health Care Financing Administration (HCFA) is 
continuing efforts to reduce costs and administrative waste. 

As of April 1, 1996, a new editing process will be 
implemented for assigned claims which will save the 
Medicare Trust Fund millions of dollars. For some time, the 
denial of claims with incomplete or invalid information has 
resulted in claims surfacing inappropriately into the appeals 
process. This practice has not only been costly, it has 
resulted in an inappropriate use of the appeals system. 

This new editing process will return paper or electronic 
claims to you as unprocessable if the claim contains certain 
incomplete or invalid information. No appeal rights will be 
afforded to these claims, or portion of these claims, because 
the “initial determination” can not be made; rendering the 
claim unprocessable. 

The bulletin contains a matrix that instructs providers on how to 
handle certain issues. The matrix states that claims will be returned as 
unprocessable if the information supplied for certain sections of the 
claim form (the HCFA Form 1500) is incomplete or invalid. The matrix 


39 See 59 FRat 10291. 
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indicates that Medicare will reject claims if the information regarding 
diagnosis codes is incomplete or invalid. 40 

4. The Health Insurance Portability and Accountability 
Act of 1996 (HIPAA) 

The landscape concerning the use of diagnosis codes changed once 
again with the enactment of the Health Insurance Portability and 
Accountability Act of 1996 (HIPAA) on August 21, 1996. HIPAA 
amended various statutes including the Internal Revenue Code of 1986 
and the Social Security Act. Title II of HIPAA, entitled “Preventing 
Health Care Fraud and Abuse; Administrative Simplification; Medical 
Liability Reform,” mandated certain requirements for Medicare claims. 
In particular, Section 1173(c) mandated that the program establish 
standardized codes for the data required for Medicare claims. As part of 
that requirement, HIPAA required HHS to establish a standardized set of 
codes, including diagnosis codes, for all Medicare claims. 41 [As noted 
above, Medicare regulations already required hospitals and physicians to 
use ICD-9-CM for diagnoses in connection with the submission of DME 
claims.] 


5. The Balanced Budget Act of 1997 

Section 4317 of the Balanced Budget Act of 1997 expanded the 
requirement for medical professionals to provide diagnostic information 
for Medicare claims. The Act added additional medical professionals to 
the definition of “practitioner” in 42 U.S.C. 1395(u) such as a physician 
assistant, nurse practitioner or certified nurse anesthetist. This Act also 
stated that, when an item or service ordered by a practitioner is provided 
by “another entity” (including a DME supplier) and Medicare requires 
that entity to provide diagnostic information, the practitioner must 
provide the diagnostic information at the time the item or service is 
ordered. 

6. I mplementation of HIPAA in 2003 

Pursuant to the requirements set forth in HIPAA, CMS published a 
bulletin on June 13, 2003, entitled “Establishing New Requirements for 
ICD-9-CM Coding on Claims Submitted to Medicare Carriers - 
Increased Role for Physicians/Practitioners.” The bulletin stated that, 
pursuant to the requirements established by HIPAA, for claims with 
dates of service on or after October 1, 2003: 


40 See February 1 996 HCFA Provider Bulletin, Section 5.0. 

4! See Section 1173 (a) (1), Public Law 104-191, August 21, 1996. 
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ICD-9-CM diagnosis codes must be included on all Medicare 
electronic and paper claims billed to Part B carriers, with the 
exception of ambulance claims. Providers and suppliers rely 
on physicians to provide a diagnosis code or narrative 
diagnostic statement on orders/referrals. This guidance 
serves as a reminder that physician/practitioners must provide 
a diagnosis on all orders and referrals. 

The bulletin states under the heading, “New Policy,” that any claim 
(other than ambulance services) submitted for payment that does not 
contain a valid diagnosis code will be returned as unprocessable: 

Effective for dates of service on or after October 1, 2003, all 
paper and electronic claims submitted to carriers must 
contain a valid diagnosis code with the exception of claims 
submitted by ambulance suppliers. . . . Carriers will return as 
unprocessable paper and electronic claims that do not contain 
a valid diagnosis code with the exception of claims submitted 
by ambulance suppliers. ... Therefore, the diagnosis code 
must be entered on the claim by the submitter. 

This bulletin, like the 1996 HCFA bulletin, made clear that all claims 
must contain the complete and valid diagnosis code in order to be 
accepted for processing. 

Following the implementation of the HIPAA regulations in 2003, 
CMS repeatedly emphasized to DME suppliers that they must provide 
valid diagnosis codes in their claims. For instance, in February 2004, 
CMS issued a bulletin instructing its claims processing contractors to 
strengthen the review of claims to ensure that claims containing invalid 
diagnosis codes, among other errors, would be rejected. This bulletin, 
which is reproduced in Figure 3 below, required CMS’s contractors to 
reject all inbound electronic claims that contained an invalid diagnosis 
code. This change was effective as of July 1, 2004. Notably, under the 
headings “Provider Action Needed” and “Caution - What You Need to 
Know,” the bulletin stated that Medicare providers - such as DME 
suppliers and physicians - should note that Medicare systems are 
strengthening system edits to ensure that submitted claims are HIPAA 
compliant, including containing diagnosis codes. 
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STOP-ImpacttoYou 
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Affected providers should stop submitting electronic claims with diagnosis codes, zip 
codes, or telephone numbers that are not HIPAA compliant, 
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Providers should note that Medicare systems are strengthening their system edits to 
assure receipt of HIPAA compliant claims. Effective July 1, 2004, Medicare will 
reject electronic claims that have diagnosis codes, zip codes, or telephone numbers 
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Mare not HIPAA compliant, 
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Be sure your billing systems are modified to generate electronic claims that will pass 
Medicare’s HIPAA compliancy edits for diagnosis codes, zip codes, and telephone 
numbers. 


Figure 3 
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In 2007, CMS issued another bulletin to Medicare providers 
further confirming that valid diagnosis codes must be included in all 
DME claims. CMS published the Medicare B News bulletin, entitled 
Common Billing Errors to Avoid When Billing Medicare Carriers, 
which discussed frequent billing problems in Medicare claims. 42 One of 
the common billing errors listed involved diagnosis codes, stating: 

Diagnosis codes being used are either invalid or truncated. 
Diagnosis codes are considered invalid usually because an 
extra digit is being added to make it 5 digits. Please 
remember not all diagnosis codes are 5 digits. Please check 
your ICD-9-CM coding book for the correct diagnosis code. 43 

These bulletins illustrate that, at least since the implementation of 
HIPAA in 2003, DME suppliers have been required to provide valid 
ICD-9-CM diagnosis codes. Despite the requirement to include 
diagnosis codes, however, it is clear based on comments made by CMS 
officials and the results of the Subcommittee’s review that the codes are 
not used effectively to help ensure payments are made on claims that are 
medically necessary or utilized as a mechanism to prevent fraud, waste, 
and abuse. 

IV. ANALYSIS 

The Subcommittee’s investigation has focused on fraud, waste, and 
abuse in claims submitted by DME suppliers and the efficacy of 
oversight by CMS and its contractors designed to prevent such abuses. 44 
The Subcommittee’s review reveals that the laws governing the use of 
diagnosis codes in DME claims have been inconsistent and, even after 
CMS required the submission of valid diagnosis codes for all DME 
supplier claims, Medicare does not fully utilize the submitted diagnosis 
codes to prevent fraud, waste, and abuse. For instance, Medicare has 
required hospitals and physicians to provide diagnosis codes on DME 
claims for decades; in contrast, the rules governing the use of such codes 
in claims from DME suppliers have been inconsistent. Moreover, even 
after Congress expressly required DME suppliers to provide such codes, 
the Medicare program does not use the codes for any significant 
purpose. In fact, CMS officials have emphasized to the Subcommittee 
that CMS requires DME claims to have diagnosis codes only to comply 
with HIPAA and, in the vast majority of cases, does not use them in its 
determination of whether a claim is valid or compliant with program 


42 See Medicare B News, Issue 236, April 17, 2006, MLN Matters Number: SE0712. 

43 See id. 

44 The Subcommittee’s review of the database revealed that it included only claims submitted 
from DME suppliers and did not include claims from physicians or hospitals. 
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requirements. 45 The Subcommittee examined several issues concerning 
the requirement for and use of diagnosis codes and its findings are 
presented below. 

A. Laws and Regulations Governing The Use of 
Diagnosis Codes On Claims From DME Suppliers 
Have Been Inconsistent 

1. From 1991 to 2003, Rules Governing the Submission 
of Diagnosis Code for DME Supplier Claims Were 
Unclear and Contradictory 

The laws and regulations described above illustrate the inconsistent 
history of the requirement for diagnosis codes on DME supplier claims. 
Current law, established by HIPAA in 1996 and implemented by CMS 
regulations in 2003, requires that DME claims submitted by suppliers 
must include valid ICD-9-CM diagnosis codes or else those claims will 
be rejected and returned to the supplier for correction. 46 Before HIPAA 
required the inclusion of such codes, however, the requirements 
regarding diagnosis codes on supplier submitted DME claims appear to 
shift from 1991 through 2003. Figure 4 delineates how those rules 
appeared to change over time. 


45 Subcommittee interview with CMS officials, May 10, 2008; see also CMS Response, 
Appendix, at pgs. 2-3 and CMS Response, Appendix, Addendum A, at pgs. 1 -2. 

46 See CMS Program Memorandum-Carriers, Transmittal B-03-046, Change request 2784, June 
10, 2003. 
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HISTORY OF MEDICARE RULES GOVERNING THE USE OF DIAGNOSIS 
CODES FOR DME SUPPLIER CLAIMS 

Year 

Action 

Description of Rules 

Diagnosis codes 
required for DME 
supplier claims?* 

1991 

CMS issues 1991 
Notice 

Standardizes claim submissions, including 
those from suppliers, and requires completion 
of HCFA Form 1 500, which contained blocks 
to enter diagnosis codes. 

Yes 

1994 

CMS implements 
final rale pursuant 
to MCCA 

Requires valid diagnosis codes for DME claims 
submitted only by physicians. CMS stated in 
Section III and in reference to comments made 
on the proposed rule that DME suppliers are not 
required to provide diagnosis codes. 

No 

1996 

CMS issues a 
bulletin to all 
providers 

States that claims submitted by providers, 
including DME suppliers, would be returned as 
unprocessable if the claim contained incomplete 
or invalid information. Included is a matrix that 
indicated Medicare would reject claims if 
information regarding diagnosis codes was 
incomplete or invalid. 

Yes 

2003 

CMS begins 
implementation of 
HIPAA rules 

Requires all providers, including suppliers, to 
use valid ICD-9-CM diagnosis codes on all 
electronic and paper claims, except ambulance 
claims. 

Yes 


♦Based on Subcommittee Analysis Figure 4 


In 1991, CMS issued the 1991 Notice, which mandated that all 
Medicare providers - including DME suppliers - must submit claims on 
a completed HCFA Form 1500. Considering that the Form 1500 
requires the submission of diagnosis codes and CMS emphasized that 
incomplete claim forms would be rejected, the 1991 Notice appears to 
have required DME suppliers to include diagnosis codes when 
submitting claims. Nevertheless, a few years later, CMS promulgated a 
rule in 1994 pursuant to the MCCA that required physicians to provide 
diagnosis codes on DME claims, but in the Provisions of the Proposed 
Rule section and in response to a comment, expressly excluded DME 
suppliers from this requirement. CMS could not have been clearer in its 
statement: “Durable medical equipment suppliers are not included in this 
requirement.” 47 

Although DME suppliers were excluded from the diagnosis code 
requirement in the 1994 rule, the February 1996 Provider Bulletin, 
which was issued to DME suppliers as well as physicians and other 
providers, lists diagnosis codes as required data for the submission of 
DME claims. FICFA appears to state in the 1996 bulletin that DME 
claims - including claims submitted by suppliers - that did not contain 
valid diagnosis codes would be returned and rejected. However, in its 


47 See id. at 1 02941 . 
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comments to the Subcommittee, CMS stated that prior to HIPAA 
implementation, “the DME claim processing system did not check a 
claim’s primary diagnosis code upon submission to determine whether 
the code was recognized and in the appropriate format as defined by the 
ICD-9-CM Manual.” 48 CMS goes on to comment that “one may very 
well find paid DME claims with invalid or illegitimate ICD-9 codes.” 9 
Arguably, diagnosis codes were required on claims as early as 1991, 
years earlier than HIPAA implementation in 2003, as CMS has 
suggested. 

2. Since Implementation of HIPAA in 2003, Application of 
Diagnosis Code Requirement Has Been Inconsistent 

Even after implementation of the HIPAA requirement for claims to 
contain diagnosis codes, CMS’s application of the diagnosis code 
requirement is inconsistent. As described below, the manner in which 
the Medicare claims review process examines diagnosis codes can result 
in the payment of some items tied to invalid diagnosis codes and the 
rejection of claims that contain valid diagnosis codes. 

CMS regulations require that all DME claims must use the CMS 
Form 1500. That claim form permits DME suppliers to enter up to six 
items on one form; each individual item is listed on a separate “claim 
line.” Each claim line is essentially equivalent to a separate DME claim, 
and for efficiency purposes, CMS permits up to six different claim lines 
on a single Form 1500. Because each item may relate to a different 
diagnosis, the Form 1500 contains spaces for up to four diagnosis codes. 
The claims form instructs the DME' supplier to indicate which diagnosis 
relates to the individual DME items. The pertinent section of the claim 
form (Form 1500) is reproduced in Figure 5 below. The spaces for the 
four diagnosis codes appeal' in Section 21; the codes for the DME items 
appear in Section 24. The form directs the supplier to link the applicable 
diagnosis code to the associated item through the “pointer” on the right 
of the DME item. 


48 

49 


See CMS Response, Appendix, at pg. 2. 
Id. 
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Diagnosis 
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DMEItem 
Code Entry 



Figure S 


Even though the Form 1 500 can include multiple items involving 
up to four different diagnoses, CMS informed the Subcommittee that the 
Medicare claims review system checks only whether the first diagnosis 
code - called the “primary” code - is valid and does not determine 
whether other diagnosis codes, if any, are valid: 

For claims that were processed after the installation of edits 
required by HIPAA began, the DME core claim system and 
front end started to check a claim’s primary diagnosis code 
against the current ICD-9-CM Manual list, which is updated 
October 1 of every year. This means that at present — 
assuming all other minimum claim information is valid — a 
claim with a valid primary diagnosis code will pass into the 
claim processing system. Conversely, if a claim contains an 
invalid primary diagnosis code, the claim is rejected and 
returned to the submitting supplier as opposed to being 
processed and denied. 50 


50 See id atpg. 2. 
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According to CMS, the Medicare claims review process will examine 
only the first diagnosis code on each claim, even if a claim contains 
more than one diagnosis code. 51 


CMS’s statement identifies a potential inconsistency with respect 
to applying the diagnosis code requirement. By checking only the 


primary diagnosis code 
on a given claim and 
ignoring any other 
diagnosis codes, the 
current claims review 
process could lead to 
illogical results. As 
illustrated in Figure 6, 
CMS could be paying 
claims that contain 
invalid codes and 
rejecting claims that 
contain valid diagnosis 
codes. 52 Specifically, if 
Medicare reviews only 



Figure 6 


the primary code for validity, then claim lines relating to the non- 
primary invalid codes could be paid; as a result, a claim containing a 
valid primary code but three invalid non-primary codes would not be 
rejected and Medicare would pay for the items tied to the invalid 
diagnosis codes. Conversely, if a claim contained a primary diagnosis 
code that was invalid, but the diagnosis codes for other claim lines were 
valid, the entire claim would be rejected. Thus, Medicare would be 
rejected ostensibly valid claims simply because the first diagnosis code 
on the claim form was not valid. Therefore, CMS’s implementation of 
the diagnosis code requirement appears both over-inclusive and under- 
inclusive at the same time. 


B. Medicare Does Not Effectively Utilize Diagnosis 
Codes on DME Supplier Claims 

The Subcommittee’s investigation has established that the 
Medicare claims review process does not utilize diagnosis codes 
effectively. CMS emphasized that the Medicare claims review 
processes checked that the diagnosis codes submitted with suppliers’ 
claims complied with HIPAA and CMS regulations, but in general, did 


51 See CMS Response, Appendix, at pg. 3; also Subcommittee interview of CMS officials, 
February 12, 2008. 

52 Figure 6 assumes that all other information on the claims form is correct and valid. 
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not use the codes to validate the integrity of the claim. 53 In other words, 
the claims review process verifies whether a valid diagnosis code is 
present (as required by HIPAA and CMS regulations), and whether the 
code meets the required format (the appropriate numbers and letters), but 
does not use the code to determine whether the diagnosis relates to the 
DME item purchased. In response to the Subcommittee’s initial 
conclusions concerning the use of diagnosis codes, CMS argued that 
ICD-9-CM diagnosis codes were not required for suppliers’ DME claims 
until the implementation of HIPAA in 2003 and only for the purpose of 
meeting HIPAA requirements: “[HIPAA] does not require that 
[Medicare claims review contractors] actually use any particular data 
element, including diagnosis codes, in its internal claims processes after 
it receives the claim.” 5 

CMS further commented that, for select DME items, it has 
instituted additional precautions that include the use of a claim’s 
diagnosis code. 53 In particular, for select claims subject to Local 
Coverage Determinations (LCDs), 56 edits are placed in the DME claim 
processing system to match a particular DME item (referred to as a 
HCPCS or procedure code) against a specific list of ICD-9-CM Manual 
codes that are identified in the LCD policy. 57 Although an exception 
exists for a limited number of DME items, CMS stated that “in many 
other instances, however, a claim’s ICD-9 code is not used to determine 
whether a claim should process for payment.” 58 

The Subcommittee examined data related to millions of DME 
claims in order to determine the impact of not effectively utilizing 
diagnosis codes in the claims review process. In particular, the 
Subcommittee examined claims in two categories of diagnosis codes: (i) 
claims that contained diagnosis codes with valid ICD-9-CM 
designations, and (ii) claims that contained diagnosis codes that were 
invalid, blank, or unprocessable. The Subcommittee’s analysis of these 


53 Subcommittee interview with CMS officials, May 10, 2008; see also CMS Response, 
Appendix, at pg. 2. 

54 See CMS Response, Appendix, Addendum A at pg. 1; see also id. at pg. 1 (“[F]or the sole 
purpose of achieving compliance with new healthcare industry-wide electronic claims 
transaction standards (mandated by HIPAA), CMS did begin to require DME suppliers to 
include diagnosis codes on their claims in recent years”) and at pg. 2 (“The new computer 
processes put in place by CMS during 2003 and 2004 only check the ICD-9-CM codes on the 
claim for HIPAA compliance”). 

55 According to CMS, the type of select items include blood glucose monitors, ankle and foot 
orthoses, refractive lenses, and oral anti-cancer drugs. See CMS Response, Appendix, at pg. 
2. 

56 According to CMS, LCDs are policies and coverage guidelines that are promulgated by the 
DME MAC Medical Directors. 

57 See CMS Response, Appendix, at pg. 2. 

58 Id. 
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claims suggests that examining the diagnosis codes on DME claims 
could be a valuable tool to uncover fraudulent or abusive claims. 

1. DME Claims With Valid But Questionable 
ICD-9-CM Diagnosis Codes 

The Subcommittee found a significant volume of claims that 
contained valid ICD-9-CM diagnosis codes, but the diagnosis appeared 
to raise serious questions about the legitimacy of the claim. For 
instance, the Subcommittee found claims in which the purported 
diagnosis appeared unrelated to the purchased DME supplies. The 
Subcommittee reviewed claims data from January 2001 to December 
2006 for 1 8 DME items that had been identified by law enforcement and 
Medicare oversight agencies as particularly susceptible to fraudulent 
claims or overpayments. 59 The Subcommittee’s examination of the 
claims for those 18 items found payments totaling more than $1 billion 
in which the purported diagnosis was questionable. 60 

Claims for blood glucose test strips provide an illustrative example 
of the disconnect surrounding the use of diagnosis codes. 61 Numerous 
experts interviewed by the Subcommittee have confirmed that blood 
glucose test strips are used almost exclusively for patients with 
diabetes. 62 According to experts at a prominent manufacturer that 
researches, develops, and markets diabetic supplies, blood glucose test 
strips are used for the “quantitative measurement of blood glucose.” 63 


w The law enforcement and oversight agencies included the HHS/OIG, GAO, and the Health 
Care Fraud Unit of the U.S, Department of Justice. The 1 8 items were: (1) blood glucose test 
strips, (2) standard weight power wheelchair with control, (3) high strength lightweight 
wheelchair, (4) lightweight wheelchair, (5) standard wheelchair, (6) albuteral compound 
solution, (7) negative pressure wound therapy pump, (8) oxygen concentrator, (9) power 
operated vehicle, (10) continuous airway pressure device, (11) nebulizer with compression, 
(12) walker - folding wheeled, (13) enteral feed supply pump per day, (14) nasal application 
device, (15) collagen based wound filler, (16) diabetic custom molded shoe, (17) diabetic 
shoe for density insert, and (18) wheelchair seat pad. 

60 The Subcommittee’s review of the diagnosis codes was not a medical or scientific review but 
based on a reasonableness review of the data, identifying only those diagnoses as 
questionable that did not appear to correlate with the medical device or equipment being 
prescribed. 

61 According to a HHS/OIG report, “Diabetics are taught to use special devices called blood 
glucose monitors or meters to test their blood sugar levels. Typically, patients place a tiny 
amount of fingertip blood on a test or reagent strip which produces a numeric read-out when 
inserted into the monitor. Depending on the results of the read-out, patients can adjust their 
insulin dosages or contact their physicians for further instructions. Patients usually test their 
glucose levels in this manner one or more times a day.” See HHS/OIG, Blood Glucose Test 
Strips: Inappropriate Medicare Payments, June 2000, OEI-03-98-00230, (the HHS/OIG 
Blood Glucose Test Strips Report) at pg. 5. 

62 Subcommittee interviews of experts at a prominent medical school and manufacturing 
company of diabetic supplies. 

63 Subcommittee interview of manufacturing company officials, May 26, 2008. 
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For various reasons, these products are highly susceptible to fraud and 
abuse. For instance, a June 2000 report from HHS/OIG noted that 
Medicare paid more than $79 million for test strips without proper 
documentation and that the cost to Medicare for this item had increased 
sharply between 1994 and 1997, 64 

As a result, Medicare implemented several additional restrictions 
on claims for those items. The June 2000 HHS/OIG report observed 
that, unlike most DME items, only beneficiaries with diabetes would be 
covered for blood glucose test strips, “prior to July 1, 1998, Medicare 
coverage for home blood glucose monitors and test strips was restricted 
to beneficiaries with Type 1, or insulin-treated diabetes. Medicare 
expanded coverage on that date to beneficiaries with Type 2, or non- 
insulin treated diabetes.” 65 In addition, suppliers that submit claims for 
blood glucose test strips must have documentation from the ordering 
physician that verifies that the beneficiary needs the diabetic testing 
supplies. 66 CMS stated that, because of the high incidence of abuse 
related to these products, blood glucose test strips “are governed by 
specific ... policies; therefore, their diagnosis codes do edit against a 
defined list of ICD-9 codes as the claim is processed to pay or deny.” 67 

Although blood glucose test strips have been associated with 
fraudulent activity and claims for those items must contain specific 
diagnosis codes related to diabetes, the Subcommittee found numerous 
instances in which claims for blood glucose test strips were paid, even 
though the submitted diagnosis codes were quite different from diabetes, 
such as typhoid and paratyphoid fevers, cholera, and scabies. In total, 
Medicare made payments for claims for blood glucose test strips 
containing 2,699 different ICD-9-CM diagnosis codes. The 
Subcommittee’s review of claims for blood glucose test strips revealed 
that the most frequent non-diabetes related diagnosis code for every year 
from 2001 through 2006 was chronic airway obstruction. Other 
questionable diagnosis codes for blood glucose test strips, which are 
presented in Figure 7 below, included leprosy, and psychosexual 
dysfunction, as well as respiratory, coronary, mental health and cancer 
conditions. Another questionable diagnosis code contained in several 
claims for blood glucose test strips was the bubonic plague. 


64 See HHS/OIG, Blood Glucose Test Strips: Inappropriate Medicare Payments, June 2000, 
OEI-03-98-00230. 

65 Id. 

66 See http://www.cms.hiis.gov/DiabetesSelfManagement/02_ProvResources.asp. 

67 See CMS Response, Appendix, at pg. 2. 
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Figure 7 


Experts interviewed by the Subcommittee, including officials from 
the Centers for Disease Control and Prevention (CDC), a prominent 
medical school and a manufacturer of diabetic supplies, confirmed that 
none of the diagnoses in Figure 7 would justify the use of blood glucose 
test strips. 68 The medical school experts stated, “In general, the use of 
glucose test strips is justified by a diagnosis in the codes that relate to 
diabetes,” and that if the listed diagnosis codes were used for the 
diagnoses listed in Figure 7, they could have been used mistakenly. 69 
CDC experts confirmed that such items would not be appropriate 
treatment for the bubonic plague. 70 Furthermore, officials stated, “CDC 
is not aware of glucose strips being used to treat any of the conditions 
listed [in Figure 7] nor do the use of the strips diagnose infectious 
diseases [noted in Figure 7].” 7 ' 


‘ Subcommittee interviews of officials at CDC, experts at a prominent medical school, and 
diabetic supplies manufacturer. 

69 Subcommittee interview of experts at a prominent medical school, April 29, 2008. 

70 Subcommittee interview of CDC officials. May 23, 2008. 

71 Id. 
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The Subcommittee’s review of the remaining 17 items revealed 
similar instances in which the reported diagnosis codes do not appear to 
justify the purchase of the DME item or appear medically improbable. 
Figure 8 below presents examples of claims that contained diagnosis 
codes that appear improper. 


K\ vmpi.es oe Questionable I)i vcnosks lor .selected 1 iems ] 

J Purchased Item 

Stated/Purported Diagnosis £ 

D beue Shoe? 

Diabetic Shoe Density Insert 

......... . | 

Traumatic Amputation of I*eg($) j 

Precocious Sexual Development and Puberty, 
Not Elsewhere Defined 


■ill 

Wheelchair Pad 

Acquired Deformity of Nose 

! ■ 

■; ", ■ I 

Power Wheelchair 

Sprained Wrist 

Walker 

Paraplegia 


Figure 8 

2. DME Claims With Invalid Diagnosis Codes Contain 
Potential Instances of Fraud, Waste, and Abuse 


In addition to examining claims with valid, but questionable, 
diagnosis codes, the Subcommittee analyzed Medicare payment data for 
DME claims submitted by suppliers from 1995 through 2006 that 
contained blank, invalid, or unprocessable diagnosis codes. The 
Subcommittee’s analysis revealed that Medicare spent billions of dollars 
on claims from DME suppliers that contained one or more invalid 
diagnosis codes, although the volume of such payments decreased 
dramatically after the implementation of HIPAA in 2003. 

As noted above, a valid ICD-9-CM code is a numeric and, in some 
circumstances, alphanumeric code that ranges from three to five digits. 
Examples of valid diagnosis codes include 496 (chronic airway 
obstruction), E813.8 (motor vehicle traffic accident involving collision 
with other vehicle injuring other specified person), and 428.0 
(congestive heart failure unspecified). In contrast, the data examined by 
the Subcommittee included codes that were obviously invalid, as 
indicated in Figure 9 below, such as unusual combinations of letters and 
numbers, as well as non-alphanumeric characters such as slashes, dashes 
and other “special characters.” For instance, the Subcommittee observed 
claims in which the purported diagnosis codes were “////” “?” “@” “ — ” 
and “zzzzz.” 
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EXAMPLES OF VALID ICD-9-CM 
DIAGNOSIS CODES 

SUBMITTED DIAGNOSIS 
CODES 

493 (Asthma) 

250.0 (Diabetes) 

020.0 (Bubonic Plague) 

001 (Cholera) 

428.0 (Congestive heart failure unspecified) 

I 

//// 

G 


Figure 9 


To determine the magnitude of the payments for claims with blank, 
invalid, or unprocessable diagnosis codes, the Subcommittee examined 
claims data, identified invalid codes, and selected the 198 invalid 
diagnosis codes that had the highest total of payments in dollar amounts 
from 1995 to 2006. 72 The Subcommittee’s analysis revealed that, from 
1995 through 2006, Medicare paid almost $5 billion for more than 60 
million DME items on claims that contained one or more of those 1 98 
invalid diagnosis codes. 73 Figure 10 provides illustrations of invalid 
diagnosis codes, with the total volume of claims submitted with those 
codes and the amounts paid in connection with those claims. 


EXAMPLES OF INVALID DIAGNOSIS CODES AND PAYMENTS 
MADE FOR ASSOCI ATED CLAIMS 
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Figure 10 


433,201 S 19,558,552 

95,905 - - S 3,798,484 


The Subcommittee found that the overwhelming majority of these 
claims - more than 56 million DME items on claims totaling more than 
$4 billion in payments - contained the word “NULL” in the diagnosis 
code field. CMS and its data contractor, commonly called the Statistical 


72 The Subcommittee initially examined the claims data associated with the 300 codes that had 
the highest total payments from 1995 through 2006 and whose codes were described in 
Medicare claims data as ‘‘Invalid Diagnosis Code.” CMS and its data contractor, called 
SADMERC, informed the Subcommittee that SADMERC data regarding the descriptions of 
diagnosis codes was inaccurate and out-of-date. As a result, the Subcommittee examined the 
actual ICD-9-CM codes for these entries; in doing so, the Subcommittee determined that 102 
were valid codes that had been incorrectly described as invalid by the SADMERC. [The fact 
that the SADMERC, CMS’s data contractor, had inaccurate data concerning millions of 
claims is addressed in Section C below.] Of the remaining 198 codes, the Subcommittee 
found that 143 codes have never been valid ICD-9-CM codes and 55 of the codes were 
invalid at some point from 1995 through 2006. For the diagnosis codes that had become 
valid at some point from 1995 to 2006, the Subcommittee included only those claims that 
were submitted using a diagnosis code before the code became valid. 

73 This finding does not include the $720,788,318 paid for 8,206,776 DME items on claims 
from 1995 through 2002 in which the associated invalid diagnosis code was “XX000.” As 
described in Section V.B., CMS officials contend that the code XX000 was a “fictitious” 
code created by CMS and its contractors for use in certain narrow circumstances to comply 
with requirements imposed by MCCA. 
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Analysis DME Regional Carrier or SADMERC,' 4 informed the 
Subcommittee that, when a claim contained an unprocessable diagnosis 
code or the relevant field was blank, the SADMERC would enter 
“NULL” into the relevant block in order to facilitate the storage and 
retrieval of that claim data. 73 Unprocessable entries, according to 
SADMERC, included diagnosis codes that had (i) symbols, such as a 
tilde (~), (ii) non-printable entries including a carriage return, a tab, or a 
space, or (iii) icons, such as a smiley face. 76 Such unprocessable entries 
or a blank field, according to SADMERC, would cause the relevant 
claims to be omitted from certain data analysis functions. In order to 
prevent the deletion or omission of these claims, SADMERC would 
enter the NULL value into the related claims data after a claim had 
already been paid or denied and the claim had been transferred to 
SADMERC for claims analysis. Thus, the claims with a NULL value in 
the diagnosis field do not reflect that the claim was submitted with 
“NULL” as the diagnosis code; to the contrary, the NULL designation 
identifies claims that were paid when the diagnosis code was 
unprocessable or blank. 

To determine the accuracy and legitimacy of claims with invalid 
codes, the Subcommittee obtained full claims data concerning 
approximately 650,000 of the 60 million DME item claims that 
contained invalid diagnosis codes. The Subcommittee arbitrarily 
selected a subset of 2,000 claims from the 650,000 claims for further 
investigation. 77 For each of these claims, the Subcommittee contacted 
the doctors whose Unique Physician Identification Number (UPIN) was 
associated with the claims to verify the accuracy of the submitted 
information. The Subcommittee determined that more than 30 percent 
of the 2,000 claims could not be verified as legitimate and bore 
characteristics of fraudulent activity. Some of these suspicious claims 
involved the following: 


74 SADMERC is the CMS contractor responsible for collecting and analyzing data regarding 
Medicare DME claims. As of August 2008, CMS has transitioned to a new data contractor. 

75 Subcommittee interview of SADMERC officials. February 28, 2008; see also CMS 
Response, Appendix, at pp. 6-7. SADMERC, which is an acronym of the Statistical Analysis 
DME Regional Carrier, is discussed in greater detail in Section V.C. 

76 Subcommittee communication with SADMERC officials, February 28, 2008. 

77 The Subcommittee obtained the information used in this study from claims data that had been 
previously provided by SADMERC and that contained complete claims information 
including the physician, beneficiary and supplier names and address as well as the treatment 
and diagnosis. The Subcommittee selected a group of claims from this data based on the 
diagnosis description being “invalid diagnosis code.” The data was not selected based on a 
purely random formula and could not be described as random for statistical analysis 
purposes. Therefore, the results are limited to the specific claims reviewed and the 
Subcommittee did not extrapolate these findings to the entire universe of relevant claims. 
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• For 101 claims that were filed after 2001, the doctor who 
allegedly prescribed the DME items had died in 2004 and, 
according to a family member interviewed by the 
Subcommittee, had not practiced medicine since the early 
1990s. 

• For 213 claims that were submitted after 2001 , the identified 
doctor had retired from the practice of medicine in the late 
1990s, and the address listed as the place of business for the 
doctor was never occupied by that doctor. 

• A physician that purportedly prescribed items associated with 
1 82 claims told the Subcommittee that he had never treated 
the patients involved. 

• For 345 claims, the doctor involved verified that he had not 
treated nor prescribed the DME items involved in 39 claims, 
which is more than 12 percent of the claims filed using his 
UPIN and containing invalid diagnosis codes. 

• A doctor reviewed 96 claims that contained his UPIN and 
said that 15 claims were from patients whom he had never 
treated. He also said that 13 claims were monthly payments 
for a hospital bed for a patient who died one month after 
receiving the bed. The supplier continued to bill Medicare 
and was paid for the bed for 12 months after the patient’s 
death. 

• The Subcommittee identified 36 claims for DME that were 
allegedly prescribed by a pediatrician where the claims were 
for elderly patients. 

As discussed in detail in Section V.A., CMS has asserted that 
Medicare rules did not require DME suppliers to provide valid diagnosis 
codes on their claims until the implementation of HIPAA in 2003. The 
Subcommittee’s review of the claims data, however, revealed that 
Medicare continued to pay DME suppliers for claims that contained 
invalid diagnosis codes after the 2003 implementation of HIPAA. The 
volume and amount of these claims decreased precipitously since 2003, 
but the data indicated that Medicare paid more than $23 million for 
DME claims from suppliers that contained invalid diagnosis codes after 
HIPAA regulations were implemented. 

In 2004, Medicare paid $10,746,665 for claims with invalid 
diagnosis codes included in the top 198 invalid diagnosis codes list. In 
2005 and 2006, the amounts paid for supplier claims with invalid 
diagnosis codes were roughly $1,447,997 and $10,991,268 respectively. 
These figures likely understate the volume of claims paid with invalid 
diagnosis codes because the Subcommittee’s analysis was limited to the 
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198 invalid codes with the highest total payments during the period 
reviewed. 78 In sum, the lower volume of payments from 2004 through 
2006 indicate that Medicare has made great strides in ensuring that only 
claims with valid diagnosis codes are accepted, although the amounts 
also indicate that an unknown number of claims with invalid diagnosis 
codes continued to pass through the system undetected after 2003. 

C. Claims Data Maintained By CMS’s Data 
Contractor Was Incorrect and Not Updated In 
A Timely Manner 

The Subcommittee’s investigation uncovered a problem related to 
a large subset of DME claims data. As noted above, the Subcommittee’s 
investigation included a detailed review of data concerning Medicare 
claims from DME suppliers submitted between 1995 and 2006. The 
Subcommittee obtained the relevant claims data from SADMERC. 79 
SADMERC is the CMS contractor responsible for collecting and 
analyzing data regarding Medicare DME claims. SADMERC described 
its responsibilities as (i) providing data analysis support to the DME 
Program Safeguard Contractors; (ii) offering guidance to manufacturers 
and suppliers on the proper use of the Healthcare Common Procedure 
Coding System (HCPCS) and is the means by which DME services are 
identified for Medicare billing; (iii) performing a variety of national 
pricing functions for DME services; (iv) assisting CMS with the DME 
Fee Schedules; and (v) analyzing DME fees to identify unreasonable or 
excessive reimbursement amounts. 80 

One of SADMERC ’s primary roles in fighting against fraud, 
waste, and abuse is its analyses of claims data and supplier billing 
patterns. In fact, CMS underscored the importance of SADMERC’s role 
in the Medicare program and emphasized its role in combating fraud, 
waste, and abuse in Medicare: 

The SADMERC’s data is used by many to develop policies, 
facilitate program integrity activities, and to support special 
initiatives. Further, Federal and state law enforcement 
agencies, including the Department of Justice and the Office 
of the Inspector General, have utilized the SADMERC’s data 


78 The Subcommittee noted that there were more than 39,000 different codes used on claims 
from 1995 through 2007, while the 2006 version of the ICD-9-CM listing only contained 
13,549 diagnosis codes. 

79 During the relevant timeframe, SADMERC was the CMS contractor responsible for 
collecting and analyzing data regarding Medicare DME claims, 

80 See http://www.palmettogba.com/palmetto/Other.nsf/Home/Other+Medicare+Partners+ 
SADMERC+Home ?OpenDocument (accessed May 7, 2008). 
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and reports in both civil and criminal cases, without 
• 81 
question. 

The claims data that the Subcommittee received from SADMERC 
contained a category of information - called the Diagnosis Description 
field - that described the diagnosis code associated with each individual 
claim. As previously explained, for the review of invalid codes, the 
Subcommittee initially reviewed the top 300 codes described as invalid 
based on the amount paid from 1995 through 2006. That analysis 
indicated that claims totaling more than $6.3 billion were paid in which 
the Diagnosis Description field stated “Invalid Diagnosis Code.” After 
discussions with CMS and SADMERC officials, the Subcommittee 
examined the codes and found that 102 of the 300 purportedly invalid 
codes were in fact valid. This reduced the scope of review to the 
remaining 198 codes. Of those 198 codes, 143 codes had never been 
valid and 55 codes became valid at some point during the relevant 
timeframe. In total, the Subcommittee’s analysis of the 198 diagnosis 
codes revealed that the amount paid for claims with invalid diagnosis 
codes from 1995 to 2006 was $4.8 billion. Thus, SADMERC data field 
of Diagnosis Descriptions overstated the amount of claims with actual 
invalid diagnosis codes by more than $1.4 billion. Notably, the 
Subcommittee’s initial analysis was limited to the top 300 codes, and 
therefore, the extent of the overstatement related to the SADMERC 
Diagnosis Description field could be materially larger. 

To its credit, CMS discovered that SADMERC data describing 
diagnosis codes was defective and informed the Subcommittee. CMS 
assessed the data and determined that the Diagnosis Descriptions for the 
entire batch of claims data was flawed: “The apparent disconnect 
between the SADMERC ICD-9 code description and the current ICD-9- 
CM Manual indicates to us that the SADMERC description field is not 
reliable.” CMS provided a detailed explanation of the errors as follows: 

Following our meeting with the PSI staff on February 12, 

CMS approached its contractor, the SADMERC, to discuss 
the reports it had provided to the PSI staff, with a focus upon 
the ICD-9 description field contained in the reports. In 
response, the SADMERC advised CMS that they had 
provided the requested files to the PSI staff at their request, 
with the clear indication both orally and via e-mail that the 
source table used to determine whether a diagnosis code was 
valid was not regularly updated, and was believed to have 
last been updated in August 2003. Since this initial response, 
the SADMERC has now informed us that they cannot 


81 See CMS Response, Appendix, at pg. 9. 
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confirm the last time the file was actually updated, nor can it 
document the source of the ICD-9 table that it conveyed to 
the PSI staff. After independently reviewing the ICD-9 
codes and sample claims from the SADMERC reports 
against actual claims history, CMS is not at all confident that 
the field in the SADMERC reports describing the validity of 
a particular ICD-9 code can be relied upon conclusively for 
any period of time. 82 

Thus, it appears that some data maintained by CMS’s data 
contractor was (a) incorrect, (b) supplied by an unidentified source, and 
(c) outdated by at least four years and possibly longer. It is unclear at 
this stage whether the data originated with SADMERC, CMS, one or 
more of the Medicare carriers, or an unrelated third-party; accordingly, it 
would be premature to hold SADMERC or any other party responsible 
for that incorrect data and this report makes no finding in that regard. 
Nevertheless, the revelation of a large amount of flawed, unsourced, and 
outdated data maintained by SADMERC - Medicare’s data contractor - 
raises concerns about both the validity of other data maintained by 
SADMERC and the level of oversight performed by CMS on one of the 
Medicare program’s most important contractors. As noted above, 
SADMERC plays a crucial role in the prevention of fraud, waste, and 
abuse in the Medicare program by maintaining, examining, and 
reporting various analyses on the voluminous claims data. Its ability to 
identify abusive practices and trends is dependent on accurate claims 
data. While it is clear that the descriptions of diagnosis codes are not the 
most important data maintained by SADMERC, it is also clear that there 
was a breakdown of some variety in the Medicare data maintenance 
processes. 

For the purposes of the Subcommittee’s investigation, the incorrect 
data in the Diagnosis Descriptions field had no impact on the findings in 
this Report, including the analysis of more than $4.8 billion in payments 
from 1995 to 2006 for DME supplier claims that contained invalid 
diagnosis codes. The analysis in this Report did not rely on the 
Diagnosis Description field; in contrast, the relevant findings were based 
on a review of the actual diagnosis codes submitted with the claims, 
rather than the flawed description of those codes in SADMERC data 
fields. 

V. CMS COMMENTS 

Over the course of its investigation, the Subcommittee has had 
extensive interaction, including numerous interviews and briefings, with 


82 See CMS Response, Appendix, at pg. 7 (emphasis in original). 
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officials from CMS and its contractors. In February 2008, the 
Subcommittee presented to CMS its preliminary findings concerning the 
prevalence of invalid diagnosis codes in DME supplier claims and 
provided supporting analysis containing examples of the claims at issue. 
The Subcommittee invited CMS and its contractors to comment on the 
Subcommittee’s initial conclusions. 

CMS provided substantial comments to the Subcommittee’s 
preliminary findings and conclusions and its complete response is 
attached to this Report in the Appendix. While most of CMS’s 
responses have been incorporated in this Report, several issues warrant 
further discussion and are examined below. 

A. CMS Assertion That Diagnosis Codes Were Not 
Required For DME Supplier Claims Until 
Implementation Of HIPAA In 2003 

In response to the Subcommittee’s initial conclusions concerning 
the use of diagnosis codes, CMS argued that ICD-9-CM diagnosis codes 
were not required for suppliers’ DME claims until the implementation of 
HIPAA in 2003. According to their comments: 

Historically, CMS did not generally require DME suppliers 
to include ICD-9-CM codes with their claims. CMS now 
requires DME suppliers to include diagnosis codes with their 
claims, and requires its DME claims processing contractors 
to check these codes, but this Medicare requirement is a 
relatively new one that was put in place during 2003 and 
2004 for the sole purpose of achieving compliance with new 
healthcare industry-wide electronic claims transaction 
standards (mandated by the Health Insurance Portability and 
Accountability Act). Accordingly, depending on the date a 
DME claim was processed, the claim may, in fact, have been 
paid without a valid ICD-9 code as defined by the ICD-9-CM 
Manual and, regardless of the ICD-9 code’s validity, it does 
not necessarily mean that the claim was paid inappropriately 
or that it was processed incorrectly^] 83 

As a threshold matter, over the course of its inquiry, the 
Subcommittee conducted numerous interviews concerning the 
requirements surrounding diagnosis codes, including frequent 
communications with officials from CMS, SADMERC, DME carriers, 
and DME suppliers. The Subcommittee repeatedly confirmed with 
those officials that diagnosis codes were required for DME supplier 
claims and confirmed that the requirement had been in place for many 


83 See CMS Response, Appendix, at pg. 1. 
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years. In fact, one CMS official stated that the requirement for diagnosis 
codes for DME claims from suppliers had been in effect “since the 
Program began.” 84 Other officials stated that they believed that 
Medicare required diagnosis codes on supplier claims for DME have 
“always” been required. 85 In fact, a representative of one large DME 
supplier stated that Medicare required valid diagnosis codes for their 
claims since 1993. 86 These comments and the fact that significant 
claims data stretching back to 1995 included diagnosis codes further 
support the Subcommittee’s finding that the laws and regulations 
governing diagnosis codes were unclear prior to 2003 and the use of the 
codes was inconsistent. Moreover, when the Subcommittee briefed 
CMS and its contractors on its initial findings in February - a meeting 
that included numerous officials from CMS and its contractors - not a 
single representative from CMS or its contractors indicated that 
diagnosis codes were not required for suppliers’ claims until 2003. 
Roughly one month later, however, CMS submitted its official response 
and asserted - for the first time - its position that Medicare rules did not 
require diagnosis codes for DME claims from suppliers until the 
implementation of HIPAA in 2003. 

Putting aside the fact that CMS’s official written response to the 
Subcommittee’s Report appears to conflict with earlier statements from 
its officials, contractors, and others, the assertion that diagnosis codes 
were not required for supplier claims until 2003 is also arguably 
inconsistent with its own regulations. As described above, the 1991 
Notice and the bulletin issued to all providers in 1996 arguably require 
the use of valid diagnosis codes on all DME claims - including those 
submitted by suppliers. It would therefore be reasonable to conclude 
that any payments for claims with invalid or incorrect diagnosis codes 
after those bulletins were improper. 

Regardless of any potential inconsistencies between CMS’s 
official written response, prior oral statements made by CMS officials, 
and the governing Medicare regulations, the Subcommittee staff has 
accepted CMS’s assertion that diagnosis codes were generally not 
required for DME claims submitted by suppliers until the 
implementation of HIPAA in 2003. Accordingly, this Report does not 
find that the payments made for the DME supplier claims with invalid 
diagnosis codes were per se improper. To the contrary, the relevant 
findings in this Report are limited: Based on the data obtained from 
SAD.MERC, the Subcommittee found payments totaling more than $4.8 
billion for the DME claims submitted by suppliers that contained invalid 


84 Subcommittee interview of CMS officials and contractors, January 1 0, 2008. 
ss Subcommittee interview of CMS officials and contractors, December 19, 2007. 
86 Subcommittee interviews of DME supply company representatives, March 2008. 
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diagnosis codes; a review of 2,000 sample claims that contained invalid 
codes indicated that roughly 30 percent of those claims could not be 
verified as legitimate. 

While CMS’s assertion that DME suppliers were first required to 
submit diagnosis codes in 2003 may impact the analysis related to 
claims with invalid codes, it has little impact on the analysis of claims 
with questionable diagnoses. To the contrary, the Subcommittee’s 
review revealed that claims with questionable diagnosis codes continued 
long after Medicare required ICD-9-CM diagnosis codes. 

Claims for blood glucose test strips once again provide a telling 
example. In 2001, Medicare paid $526,059 for claims for blood glucose 
strips with a diagnosis of chronic airway obstruction; Medicare paid 
roughly the same amount - $535,032 - for the same product with the 
same questionable diagnosis code in 2006. In fact, as noted above, 
chronic airway obstruction was the single most frequent diagnosis code 
for blood glucose test strips for each year from 2001 through 2006, and 
the amount of claims paid over those years fluctuated little from the time 
before diagnosis codes were required (2001-2003) through the following 
three years (2004-2006). 

Figure 1 1 below presents the most frequent non-diabetes diagnosis 
codes for blood glucose test strips and illustrates that the use of these 
questionable codes did not decrease - and, in some cases, increased 
substantially - after diagnosis codes were required in 2003. The amount 
paid for blood glucose test strips for one questionable diagnosis code - 
urinary incontinence - more than doubled in just a few years following 
the requirement of valid diagnosis codes on supplier claims (2003- 
2006). Therefore, the analysis of claims data for these IB prominent 
DME items suggests that, even after valid diagnosis codes became a 
required element of supplier claims in 2003, the claims review process 
conducted by Medicare carriers did not examine whether the diagnosis 
codes related to the purchased supplies. 
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Figure 11 

B. “XXOOO,” A Prominent Invalid Code, Was 
Created By CMS 

As part of its preliminary findings, the Subcommittee identified 
8,206,776 claims amounting to $720,788,318 in payments from 1995 
through 2002 in which the associated diagnosis code read “XXOOO.” 
XXOOO is not on the ICD-9-CM list of diagnosis codes, and therefore, 
the Subcommittee initially considered it an invalid code. CMS has 
asserted that the code XXOOO should not be considered invalid because it 
was a “fictitious” code created by CMS and its contractors to comply 
with requirements imposed by MCCA. 
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As noted above, MCCA, enacted in 1 988, required that all claims 
for services or items submitted by physicians contain a valid diagnosis 
code. In requiring the inclusion of 
diagnosis codes, the MCCA drew a 
distinction between two categories of 
Medicare claims - “assigned” and 
“unassigned” claims. In general, 
assigned claims are those in which 
the physician has accepted the claim 
on assignment from the beneficiary 
and agreed with Medicare to accept 
the Medicare fee schedule. 

Unassigned claims are those in which 
the physician has not agreed to 
accept assignment of the claim or to 
abide by the Medicare fee schedule. 

[A detailed description of assigned 
and unassigned claims is set forth in 
Figure 12 on this page.] 


With respect to assigned 
claims, the MCCA required that 
Medicare deny payment to claims 
that did not contain the proper 
diagnosis code. For unassigned 
claims, the MCCA authorized the Secretary to institute civil fines and 
penalties against physicians who refuse to provide valid diagnosis 
codes. 87 


To comply with the requirements of the MCCA, in April 1989, 
CMS published a revision to the Medicare Carriers Manual, Part 3, the 
guidance provided to Medicare DME carriers that instructed them on 
how to process Medicare claims. The April 1989 revision directed 
carriers how to process claims under the new diagnosis code 
requirement for physicians. The new rule also instructed carriers to 
deny any assigned claim submitted by a physician without a valid 1CD- 
9-CM diagnosis code after June 1, 1989; in doing so, the rule also 
established a grace period until June 1989 to allow physicians to comply 
with the new diagnosis code rules before denying the claim. 88 


87 CCA did not allow unassigned claims to be denied because it was desirable to reimburse the 
beneficiary. Once the physician was contacted regarding the failure to provide a valid 
diagnosis code, however, they were subject to the fines and civil penalties if they did not 
promptly provide them. 

88 See Medicare Carriers Manual Part 3 - Claims Process, No. 1298, April 1 989. 
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As part of the grace period, CMS established the use of the 
fictitious diagnosis code, XX000, which was supposed to be entered into 
the relevant diagnosis field when the block was improperly left blank. 89 
Importantly, according to the Medicare Carriers Manual revision, this 
fictitious code was supposed to be used only in connection with assigned 
claims submitted by physicians during the grace period - i.e., up to June 
1 , 1 989 - but not after that date. 90 Carriers could, however, continue to 
use the fictitious code after that grace period, in instances where a 
physician failed to provide a valid diagnosis code on unassigned claims. 
According to the Carrier Manual revision, the purpose of the fictitious 
XX000 code was to identify those physicians that did not comply with 
the rules by providing the valid diagnosis codes. The revisions stated, 
“The fictitious code will identify claims adjudicated without an actual 
ICD-9-CM code from the physician. Unassigned claims submitted 
without the ICD-9-CM code must be recorded on an individual 
physician basis. These records will be used to monitor compliance in 
accordance with §§7600-7604.” 

Section 7600 referred to that section of the Carriers Manual that 
directed monitoring the use of diagnosis codes on unassigned claims. 
Section 7601 (A) required carriers to produce a monthly report of 
physicians who did not furnish diagnosis codes on bills submitted with 
unassigned claims. The guidance indicated that, if a physician failed to 
provide diagnosis codes on more than 10 claims during a single month, 
the carrier was to contact the physician and explain the law and the 
physician’s requirement to provide the diagnosis code. 

It is clear that the fictitious code of XX000 was initially introduced 
as a temporary measure to comply with the requirements of MCCA. 
Indeed, it was initially used only for a small subset of DME claims from 
physicians and was intended to keep track of which physicians were 
failing to comply with the new diagnosis code requirements. Since 
physicians who did not provide a valid ICD-9-CM diagnosis code on 
unassigned claims were subject to fines under the MCCA, the 
Subcommittee asked CMS for any records of how many fines were 
levied annually since 1995. 91 CMS advised the Subcommittee that there 
have been no fines levied as there have been no reports from the carriers 
that physicians are refusing to provide diagnosis codes. 92 

At some point, the fictitious XX000 code was introduced for 
claims coming from DME suppliers as well as physicians. The data 


See id. 

See id. at Section 4-20.1. 

Subcommittee interview of CMS officials, April 10, 2008. 
Subcommittee interview of CMS officials, April 14, 2008. 


89 

90 

91 

92 
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received by the Subcommittee from SADMERC indicates the XX000 
code has been used on supplier claims since at least 1995, the first year 
of data reviewed. Because this code was designed to be used to monitor 
physician compliance with the requirement to provide diagnosis codes, 
any use of the code by non-physicians or on non-physician related 
claims, such as claims from DME suppliers, would appeal - to hamper 
any efforts to identify physicians who were not providing diagnosis 
codes. Because this code was used on more than eight million claims 
submitted by DME suppliers, it is impossible to determine which of 
these claims did not contain a diagnosis code because the physician 
neglected to provide one to the supplier. Therefore, the use of XX000 
for claims submitted by DME suppliers would appear to undermine the 
central purpose behind the creation of the XX000 code. 

Nevertheless, the Subcommittee staff has accepted CMS’s 
assertion with respect to the XX000 code. Accordingly, the claims that 
contain that code - which amount to more than eight million claims 
totaling more than $720 million in payments - were not included in the 
Subcommittee’s analysis of claims with invalid diagnosis codes. 
Further, the Subcommittee staff noted that the volume of claims using 
the code XX000 diagnosis code decreased dramatically following the 
implementation of HIPAA requirements in 2003. Consequently, that 
code does not represent a significant vulnerability for fraud, waste, and 
abuse going forward. 

C. “Medical Necessity” Is Determined Through 
Other Records, Not Diagnosis Codes 

As noted in Section III.3. above, the Social Security Act and 
Medicare regulations require that Medicare cannot pay for any DME 
claim unless the item is medically necessary. CMS officials stated that 
the claims review process does not normally examine a claim’s 
diagnosis code to determine whether the DME item is medically 
necessary, instead it relies on suppliers to furnish a CMN signed by the 
physician or other records to document medical necessity and on the pre- 
and post-payment review processes. 

There are several weaknesses with this practice. CMNs are not 
required for all DME items. CMNs are only required for select DME 
items, such as oxygen or infusion pumps. Further, CMNs are not 
routinely submitted with the Medicare claims. Instead, suppliers are 
required to maintain CMNs in their files and provide them during pre- 
and post-payment reviews. Therefore, Medicare claims are paid under 
the assumption that the item or items claimed are medically necessary 
and that the suppliers have the CMNs or other necessary supporting 
documentation to prove it. 
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According to CMS officials, medical necessity is reviewed during the 
pre- and post-payment review process, and that approximately three 
percent of paid claims are reviewed . 93 Because CMS processes billions 
of Medicare claims annually, this means that only a fraction of claims 
are reviewed for medical necessity and in some instances, only after 
payment has been made. As previously mentioned, past HHS/OIG 
reports have illustrated that providers have failed to establish the 
medical necessity requirement. Further, the limited number of post- 
payment reviews performed would be ineffective for identifying those 
suppliers that establish fraudulent companies. 

Preventing claims from being paid in the first place would be more 
efficient and effective than attempting to recover improperly paid 
amounts after the fact. While checking that the diagnosis code 
correlates with the DME item claimed does not prove medical necessity, 
some diagnosis code and DME item combinations discovered by the 
Subcommittee raise the questions as to the medical necessity of the 
items. 

VI. CONCLUSION AND RECOMMENDATIONS 

Considering the fact that diagnosis codes are required to be 
submitted on claims, they should be used in a meaningful manner. 
Based on the Subcommittee’s analysis, billions of DME claims have 
been paid where the purported diagnosis is questionable and does not 
appear related to the purchased equipment. CMS’s failure to effectively 
utilize diagnosis codes have resulted in questionable payments and may 
have left billions of taxpayer’s money susceptible to fraud, waste, and 
abuse. The Subcommittee believes that ensuring that diagnosis codes 
included on claims are both valid and consistent with the DME item 
supplied could be a more effective utilization of the codes by reducing 
costs for claims processing and review, helping ensure the medical 
necessity of the claim, and preventing and identifying fraud, waste, and 
abuse. CMS should do more to ensure integrity in the Medicare 
program. Strengthening internal controls on the front-end is more 
beneficial than attempting to recover improperly paid amounts after the 
fact. It is for these reasons that the Subcommittee Minority staff makes 
the following recommendations: 

1. Strengthen Claims Review Process. CMS should consider 
strengthening the claims review process by more effectively 
utilizing all diagnosis codes submitted on claims. All diagnosis 
codes entered onto a claim should be valid and medically relate 


93 According to CMS officials, this percent includes claims for both Part A (hospital insurance) 
and Part B. CMS officials stated that it spent $160 million in fiscal year 2007 to conduct pre- 
and post-payments reviews. 
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to the supplied DME items. Claims with any invalid or 
incorrect codes should be rejected and returned to the biller for 
correction. 

2. Consider Developing Procedures to Link Diagnosis Codes 
with Medical Procedures. CMS should consider developing 
processes that use the diagnosis codes to prevent, detect, and 
reject improper payments. This could include creating 
procedures to link ICD-9-CM diagnosis codes included on 
DME claims with authorized medical procedures (HCPCS), 
similar to what is already being performed by some contractors 
on select DME items. 

3. Consider Developing Procedures to Link Claims for DME 
Items with a Corresponding Claim for Medical Treatment. 

CMS should consider incorporating an edit into the claims 
processing system that would check a claim for a DME item 
against a claim for a doctor visit that would have resulted in an 
order or prescription for the item, similar to what is already 
being performed on DME claims for select items. Furthermore, 
for DME claims that do not have a corresponding medical 
treatment claims, CMS should consider performing additional 
procedures in order to ensure the medical necessity and integrity 
of the claims. 

4. Strengthen Contractor Oversight. CMS should consider 
strengthening its contractor oversight, including contractor 
penalties for making improper payments or maintaining 
unreliable data. 

♦ ♦ ♦ 
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Senate Homeland Security and Governmental Affairs Committee (HSGAC) Permanent 
Subcommittee on Investigations (PSI) 

Preliminary Conclusions Surrounding DME Payments for Invalid Diagnosis Codes: 
CMS Response - March 7, 2008 

On February 12, 2008, in a meeting between staff from the Centers for Medicare & Medicaid 
Services (CMS) and PSI staff investigators, PSI staff surfaced serious concerns about potential 
findings of incorrect claims payments as a result of an extensive review of reports shared by the 
Statistical Analysis Durable Medical Equipment Carrier (SADMERC), which focused on the 
validity of ICD-9 or diagnosis codes on durable medical equipment (DME) claims. PSI staff 
provided examples from the SADMERC reports which identified several thousand claims that 
had apparently been paid since 2001, but contained a description indicator noting that the 
diagnosis code was invalid. Flowing from these examples, PSI staff asked CMS to explain how 
a DME claim with an invalid diagnosis code could be paid, and what safeguards were in place to 
ensure that only claims with valid diagnosis codes are accepted to process. 

Since the meeting, CMS has reviewed the SADMERC reports and claim reference examples 
provided by the Subcommittee on February 12 and subsequently on February 19. CMS also 
reviewed the diagnosis codes in the report, selected a sample of the claims listed for review by 
the current DME MACs, and consulted with SADMERC staff on their report to the PSI staff. 
Based on our review and analysis, we have come to the following conclusions: 

• Historically, CMS did not generally require DME suppliers to include ICD-9-CM codes 
with their claims. CMS now requires DME suppliers to include diagnosis codes with 
their claims, and requires its DME claims processing contractors to check these codes, 
but this Medicare requirement is a relatively new one that was put in place during 2003 
and 2004 for the sole purpose of achieving compliance with new healthcare industry-wide 
electronic claims transaction standards (mandated by the Health Insurance Portability and 
Accountability Act). Accordingly, depending on the date a DME claim was processed, 
the claim may, in fact, have been paid without a valid ICD-9 code as defined by the ICD- 
9-CM Manual and, regardless of the ICD-9 code’s validity, it does not necessarily mean 
that the claim was paid inappropriately or that it was processed incorrectly; 

• Based on a claim file review of a sample of the claim lines provided by the PSI staff, it 
appears that most of the claims listed on the SADMERC reports were processed 
appropriately; and 

• The diagnosis description field in the SADMERC reports provided to the PSI staff is not 
accurate or reliable; therefore, it should not be used to conclude whether a claim was paid 
with an invalid diagnosis code. 

The basis for these conclusions stems from several different findings, including the DME claim 
processing controls that have evolved over time since 2003, a review of sample claim lines 
presented on the SADMERC reports, the validity of the ICD-9 code descriptors presented in the 
SADMERC reports, and the descriptions from SADMERC staff about the contents of the data 
they provided the PSI staff. We outline our supporting rationale for each finding below. 

I. Evolution of the DME Claims Process and Editing for ICD-9-CM Codes 

Historically, CMS did not generally require DME suppliers to include ICD-9-CM codes with 
their claims. Instead, DME suppliers were and continue to be required to maintain a doctor’s 
order in their files for each and every billing. Moreover, for some DME items, suppliers are 
expected to furnish Medicare a certificate of medical necessity signed by the physician to 
document medical necessity. CMS does now require DME suppliers to include diagnosis codes 
with their claims, and CMS requires its DME claims processing contractors to check these codes. 
However, this Medicare requirement is a relatively new one that was put in place during 2003 
and 2004 for the sole purpose of achieving compliance with new healthcare industry-wide 
electronic claims transaction standards (mandated by the Health Insurance Portability and 
Accountability Act (HIPAA)). For more information on this issue, please see Addendum A. 

More specifically, prior to HIPAA requirements that were implemented beginning in May 2003, 
DME claims were not edited in the core DME claim processing system or at the front end of the 
automated adjudication process to determine whether a claim contained a valid ICD-9-CM 
Manual code. In other words, the DME claim processing system did not check a claim’s primary 
diagnosis code upon submission to determine whether the code was recognized and in the 
appropriate format as defined by the ICD-9-CM Manual. This effectively means that for claims 
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adjudicated prior to the implementation of the HIPAA-mandated claims processing edits, one 
may very well find paid DME claims with invalid or illegitimate ICD-9 codes. For claims that 
processed after the installation of edits required by HIPAA began, the DME core claim system 
and front end started to check a claim’s primary diagnosis code against the current ICD-9-CM 
Manual list, which is updated October 1 of every year. This means that at present-assuming all 
other minimum claim information is valid — a claim with a valid primary diagnosis code will 
pass into the claim processing system. Conversely, if a claim contains an invalid primary 
diagnosis code, the claim is rejected and returned to the submitting supplier as opposed to being 
processed and denied. 

It is important to note that when a paid DME claim with an invalid ICD-9 code is identified, it 
would be incorrect to conclude that the claim was processed inappropriately or paid incorrectly. 

A DME claim’s ICD-9 code is not always used to assess whether a particular service or supply 
meets medical necessity or coverage criteria. In some cases, some DMEPOS supplies are 
covered by Medicare only if they meet the parameters outlined by Local Coverage 
Determination (LCDs) policies and coverage guidelines promulgated by the DME MAC Medical 
Directors. To implement these coverage polices, edits are placed in the DME claim processing 
system that check a particular HCPCS code (i.e., procedure code) or range of HCPCS codes 
against a specific list of covered ICD-9-CM Manual codes identified in the LCD policy. Claims 
for supplies such as blood glucose monitors, ankle and foot orthoses, refractive lenses, and oral 
anti-cancer drugs, for example, are governed by specific LCD policies; therefore, their diagnosis 
codes do edit against a defined list of ICD-9 codes as the claim is processed to pay or deny. 

In many other instances, however, a claim’s ICD-9 code is not used to determine whether a claim 
should process for payment. Rather, the claim is paid based upon whether an appropriate 
certificate of medical necessity (CMN) has been submitted or is on-file for the particular claim in 
question, or whether an appropriate modifier code has been submitted on the claim to denote 
compliance with required documentation criteria (claims for power wheel-chairs and oxygen are 
common examples of supplies that fall under this umbrella). Practically speaking, this means 
that before HIPAA implementation changes began in May 2003, it would not be uncommon to 
find DME claims that processed and paid with an invalid or illegitimate diagnosis code, but 
which were nevertheless processed and paid appropriately. The diagnosis code, whether valid or 
not, had no bearing on whether the claim was processed appropriately or paid. Following the 
implementation of HIPAA implementation edits, we would expect claims history to contain only 
valid primary ICD-9-CM Manual codes on processed claims, but whether the code was used to 
determine payment would still depend upon the type of supply or service on the claim (i.e., 
whether the supply or service on the claim required compliance with an LCD versus a CMN or 
other claim modifier to process). 

For precision, we would note that installation of claim submission and system changes to 
implement HIPAA began in May 2003 and were phased in over time. Claim submission 
requirements and some system edits on primary diagnosis codes for electronic claims to 
determine their validity began to be installed in May 2003. Other system changes to edit on 
electronic and paper claims were installed progressively in October 2003 and into July 2004, 
while additional system edits on secondary and tertiary diagnosis codes on paper claims are not 
scheduled to be completed until July 2008. The phased installation of HIPAA edits on different 
claim types and different levels of diagnosis codes on a claim means that while we would expect 
the number of DME claims submitted with truly invalid diagnosis codes to greatly diminish after 
May 2003, some paper claim lines that were relying upon secondary or tertiary diagnosis codes 
listed on a claim still are not edited for validity; as a result, a few DME claim lines with truly 
invalid ICD-9-CM Manual codes can still enter the claim processing system rather than reject. 

II. ICD-9 Code Review 

CMS reviewed the claim examples provided by the PSI staff during our February 12 meeting. 
Apart from some entries that were obviously not valid (i.e., NULL and XXOOO), we identified 53 
distinct and separate ICD-9 diagnosis codes listed on the claims. While the diagnosis code 
descriptor on the SADMERC reports indicated that all these codes were invalid, our review 
against the ICD-9-CM Manual compiled by the National Center for Health Statistics and CMS, 
which contains all coding changes issued through October 1, 2007, indicates that all but three — 
3515, 7155, and 7156 — are truly valid ICD-9 codes (see table below). In other words, only three 
codes are not and have not been listed as legitimate, defined codes in the ICD-9-CM Manual. 

Two additional codes identified as invalid may simply reflect an input error as similar, valid 
codes do exist. 
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! ICD -9 Code 

1 Number 

Code Description 

Effective date : 
of code 


Not a valid code 


1 4940 

Bronchiecstasis without acute exacerbation 

10/01/2000 

1 4941 

1 4& S 0 - v: -f 

1 5859 

1 T ?55 

Tile 

Bronchi ecstasis with acute exacerbation 




18 Bail mm 

7837 

Adult failure to thrive 

10/01/2000 

27702 

Cystic fibrosus with pulmonary manifestation 

10/01/2002 

29410 

Dementia in conditions classified elsewhere w/o behavioral 
disturbance 

10/01/2000 

32721 

Primary central sleep apnea 

10/01/2005 

32723 

Obstructive sleep apnea 

10/01/2005 

34831 

Metabolic encephalopathy 

10/01/2003 

35800 

Myasthenia gravis without (acute) exacerbation 

10/01/2003 

42820 

Systolic heart failure, unspecified 

10/01/2002 

43884 

Late effect of cerebrovascular disease, Ataxia 

10/01/2002 

45912 

Postphlebitic syndrome with inflammation 

10/01/2002 

45930 

Chronic venous hypertension w/o complications 

10/01/2002 

45933 

Chronic venous hypertension w ulcer and inflammation 

10/01/2002 

49392 

Asthma w/ (acute) exacerbation 

10/01/2002 

51883 

Chronic respiratory failure 

10/01/1998 

51884 

Acute and chronic respiratory failure 

10/01/1998 

56962 

Mechanical complication of colostomy and enterostomy 

10/01/1998 

70700 

Decubitus ulcer, unspecified site 

10/01/2004 

70701 

Decubitus ulcer, elbow 

10/01/2004 

70702 

Decubitus ulcer, upper back 

10/01/2004 

70703 

Decubitus ulcer, lower back 

10/01/2004 

70705 

Decubitus ulcer, buttock 

10/01/2004 

70707 

Decubitus ulcer, heel 

10/01/2004 

70709 

Decubitus ulcer, other site 

10/01/2004 

70710 

Ulcer of lower limbs, except decubitus, ulcer of lower limb, 
unspecified 

10/01/2000 

70713 

Ulcer of lower limbs, except decubitus, ulcer of ankle 

10/01/2000 

70715 

Ulcer of lower limbs, except decubitus, ulcer of other part of 
foot 

10/01/2000 

71502 

Osteoarthritis, generalized, upper arm 

Not Available 

71506 

Osteoarthritis, generalized, lower leg 

Not Available 

71507 

Osteoarthritis, generalized, ankle and foot 

Not Available 

71508 

Osteoarthritis, generalized, other specified sites 

Not Available 

71599 

Osteoarthrosis, unspecified whether generalized or localized, 
mult, sites 

Not Available 


A-, -lit u \ 


72887 

Muscle weakness (generalized) 

10/01/2003 

72888 

Rhabdomyolysis 

10/01/2003 

78079 

Other malaise and fatigue 

10/01/1998 

78099 

Other general symptoms 

10/01/2002 

78192 

Abnormal posture 

10/01/2000 

78340 

Lack of normal physiological development, unspecified 

10/01/2000 

78603 

Apnea 

10/01/1998 

78604 

Cheyne-Stokes respiration 

10/01/1998 

78605 

Shortness of breath 

10/01/1998 

79901 

Asphyxia 

10/01/2005 

79902 

Hypoxemia 

10/01/2005 

E 8880 

Fall resulting in striking against sharp object 

10/01/2001 

E 8889 

Unspecified fall 

10/01/2001 

V 5873 

Aftercare following surgery of the circulatory system, NEC 

10/01/2002 
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The apparent disconnect between the SADMERC ICD-9 code description and the current ICD-9- 
CM Manual indicates to us that the SADMERC description field is not reliable. We will discuss 
this further in section V of this summary. 

III. Sample Claim Review 

From the claim examples provided by the PSI staff on February 19 that contained HICNs (Health 
Insurance Claim Numbers) as well as CCNs (Claim Control Numbers), CMS selected a random 
sample of 1 1 claims with dates of service (DOS) ranging from January 2001 to November 2006 
that were processed by the Region C DME carrier or DMERC. We then provided the CCN and 
HICN to the current Jurisdiction C DME MAC, Cigna Government Services (CGS), requesting 
that they obtain a copy of the original claim to determine whether the claim submitted contained 
a valid diagnosis code and whether the claim was processed correctly. 

The DME MAC advised that they could retrieve eight of the 1 1 claims we provided them from 
their available on-line history. Of these, all eight contained valid ICD-9 codes at the time they 
were processed. Seven of the eight claims were processed and paid appropriately as they 
contained the appropriate supporting Certificate of Medical Necessity (CMN) information or 
claim modifiers. The remaining claim available on-line was denied because the amount of 
supplies being claimed was not supported by the claim information. (See table below for specific 
claim samples reviewed). 



Ko w/ adj 
flex/ext 
rotat cus 
Humidifie 
r heated 
used w 
PAP 
Domase 
alpha 
inhai sol u 


INVALID 

DIAG 

CODE 


01019833146000 


LI 845 


71506 


INVALID 

DIAG 

CODE 


062648S4453000 


E0562 


78603 


INVALID 

DIAG 


06241925709000 


37639 


27702 


Other 

power 

whlchr 


INVALID 

DIAG 


Invalid 30-Oct- 


02157150873000 


K0014 


CODE 


Walker 

folding 

wheeled 


INVALID 

DIAG 


E0143 


29410 


CODE 


06195789521000 


Portable 
gaseous 
02 


INVALID 

DIAG 

CODE 

INVALID 

DIAG 


06053746209000 


79902 


Stationary 


06171705235000 


E0439 


79901 


CODE 


Portable 

gaseous 


INVALID 

DIAG 


050 89844582000 


51883 


CODE 


E0431 


Portable 

gaseous 


INVALID 

DIAG 


CODE 


Valid DX | 06 


06310829635000 


E0431 


Rollabout 
chair with 


INVALID 

DIAG 


Invalid 04-Oct- 


02325150030000 


CODE 


casters 


i Found 

> 

iisgii 

ISSIltlRI 

' Pay 

No 

Yes 

Available 

Online 

Yes 

Available 

Online 

Yes 

No 

Yes 

05075765 

369000 

E0180 

Available 

Online 

Yes 

Available 

Online 

Yes 

Available 

Online 

Yes 

Available 

Online 

Yes 

Available 

Online 

Yes 

No 

Yes 
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The three claims out of the 1 1 sampled that the current DME MAC was unable to view from 
their on-line history were the oldest claims in the sample dating back to 2001 and 2002, 
respectively. Purged history reports were ordered for these claims, but either no report was 
available or the report that returned did not contain a CCN, date of service (DOS), and procedure 
code that corresponded to the information listed on the SADMERC report provided by the PSI 
staff. The DME MAC did note that based on the SADMERC report, two of these three claims 
contained truly invalid ICD-9 codes (7156 and 3515) and were denied. The exact reason for 
denial is unknown, however, and we continue to work to determine whether these claims are 
retrievable and if they were processed correctly. 

In addition to reviewing a general sample of claims, CMS also provided the current DME MAC 
with the CCN and HICN information for the claims on the February 19 report provided by the 
PSI staff that contained what we believe to be truly invalid diagnosis codes: 3515, 7155, 7156, 
NULL and XX000. All tallied, this amounted to 51 different claims with multiple claim lines 
on many of the claims with process dates in 2001, 2002, and 2003 respectively, with just two 
claims having processed after August 2003. As of this writing, the DME MAC was unable to 
obtain purged history reports that identify the bulk of these claims, but we continue work to 
determine if all the claims — including those with XX000 and NULL in the diagnosis field — are 
retrievable and if they were processed correctly. 

IV. Report Values 

Given the importance placed on code validity throughout the Medicare claims adjudication 
process, CMS investigated how and why NULL and XX000 appear as diagnosis codes in the 
SADMERC reports. Typically, values in data fields are read and loaded as received on the 
claims records from the Common Working File (CWF). There are exceptions, however, that 
require manual editing to facilitate data load: 

• If special reserved characters in the database or other programs would cause the data to not 
load correctly, those fields are changed to blank spaces. The following field values are 
replaced with blanks: 

- Pipe sign (I) 

- Tilde (-) 

- Carriage return 

- End of file marker 

* Any HCPCS or diagnosis field that is empty (does not contain a value) is replaced with a 
token value of NULL. In this instance, NULL was a value plugged into the field by the 
SADMERC as it loaded processed claim data from the CWF. 

With respect to XX000 appearing in a diagnosis field, prior to the implementation of HIPAA 
edits discussed earlier, DME claims processing contractors inserted XX000 into the diagnosis 
field on claims that contained no diagnosis. This was necessary in order to allow the claim to 
enter the CWF record, which was designed to look for alpha-numeric values in the diagnosis 
field before allowing a claim to enter and complete processing. Since prior to HIPAA editing 
DME claims did not require an ICD-9 code in order to enter the claim adjudication process, the 
XX000 was simply used as a filler code to allow a claim entry into the CWF, but it had no 
bearing on whether the claim processed correctly. Contractors were instructed to cease using 
filler codes in this manner as part of the HIPAA implementation instructions implemented 
October 1 , 2003. We would note that of the claim lines we reviewed that contain an XX000 in 
the diagnosis field, all appear to have been processed prior to October 1, 2003. 

V. SADMERC Reports 

Following our meeting with the PSI staff on February 12, CMS approached its contractor, the 
SADMERC, to discuss the reports it had provided to the PSI staff, with a focus upon the ICD-9 
description field contained in the reports. In response, the SADMERC advised CMS that they 
had provided the requested files to the PSI staff at their request, with the clear indication both 
orally and via e-mail that the source table used to determine whether a diagnosis code was valid 
was not regularly updated, and was believed to have last been updated in August 2003. Since 
this initial response, the SADMERC has now informed us that they cannot confirm the last time 
the file was actually updated, nor can it document the source of the ICD-9 table that it conveyed 
to the PSI staff. After independently reviewing the ICD-9 codes and sample claims from the 
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SADMERC reports against actual claims history, CMS is not at all confident that the field in the 
S ADMERC reports describing the validity of a particular ICD-9 code can be relied upon 
conclusively for any period of time. 

CMS sincerely regrets the confusion that the SADMERC’s descriptor field has generated in this 
instance. It is not unusual for the SADMERC to use certain files it obtains from other CMS 
sources or CMS contractors to fulfill requests for ad-hoc reports or for various research articles. 

For example, such information may include provider files from the National Supplier 
Clearinghouse which contain provider names and addresses, or a list of eligible Medicare 
beneficiaries provided by CMS. CMS has learned that in its desire to be responsive and 
comprehensive in the ad-hoc analysis reports and information it provides, the SADMERC has 
occasionally utilized information files from external sources (i.e., outside CMS or CMS 
contractors) to complete some specific ad-hoc reports. Prior to this event, CMS was neither 
aware of nor condoned the use of information from external sources. 

VI. CMS Corrective Action 

As a result of our analysis and findings, we have directed the SADMERC to immediately cease 
the practice of using externally sourced data files. The SADMERC has been directed to provide 
a list of any outside sources it utilizes in completing ad-hoc requests and is required to seek 
approval from CMS prior to utilizing data from outside sources. The SADMERC and their 
parent company’s senior management at Palmetto Government Benefits Administrators (PGBA) 
have been made acutely aware of the significant ramifications of using outdated data and the 
serious nature of the conclusions by the PSI staff in this instance. CMS has received a complete 
and detailed report of the SADMERC’s actions related to its use of the outdated diagnosis 
code/description file. The following is a summary report from the SADMERC on the subject: 

" The SADMERC receives its claims data from CWF on a nightly basis. There is not an 
indicator on the claim itself regarding the validity of the diagnosis code . Apparently, Mr. 
Stoddard identified what he assumed were claims paid without a diagnosis code and/or 
with an invalid diagnosis code. He then requested the SADMERC to run a report 
identifying all claims paid from January 1, 1995 to January 31, 2008 with either an 
invalid diagnosis code or those claims that did not have a diagnosis code. 

In order to obtain this information, the SADMERC ran all claims paid for the time period 
against its diagnosis code file, which is only current as of August 2003. Claims 
containing diagnosis codes that were either not on the August 2003 diagnosis code file or 
where the diagnosis code descriptions had changed were identified. A report of those 
claims was then developed for Mr. Stoddard. The report identified those claims as either 
“invalid diagnosis code ” or “missing diagnosis code, " which indicates that the 
diagnosis code was either NOT on the August 2003 file or the diagnosis code did not 
match the August 2003 description for that code. In its cover letter to Mr. Stoddard, the 
SADMERC statistician advised Mr. Stoddard “Note that since the SADMERC has 
diagnosis code descriptions current as of August 2003, it is possible that diagnosis codes 
contained in your data may be currently valid. ” The "your data" refers to the report 
developed by the SADMERC. The intent of this note was to make Mr. Stoddard aware 
that the report is basically not reliable since it may contain claims data where the 
diagnosis code is now valid or where the diagnosis code did not appear on the August 
2003 diagnosis description file (obviously outdated). Further, the statistician clearly 
explained to Mr. Stoddard by phone and the cover letter that the diagnosis description 
file is outdated and the SADMERC does not maintain a current diagnosis description 
file. " 

Despite our critical view of the SADMERC’s use of unauthorized external data sources in this 
incident, we would like to point out that producing ad-hoc reports of tire kind at issue in this 
instance represents a very small portion of the SADMERC’s role in supporting payment 
integrity. Since 1992, the SADMERC’s operations have supported the DME Medicare 
Administrative Carriers (MACs) and their predecessors, DME Program Safeguard Contractors 
(PSCs), CMS, federal law enforcement agencies, and the National Supplier Clearinghouse (NSC) 
by performing the following critical functions: 

* HCPCS Coding Process for DMEPOS 

* Provide Medicare Coding Advice and Guidance 

* Establish and Distribute Pricing Files for Certain Drugs and DMEPOS 

6 
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• Statistical Analysis and Reporting 

We have no reason to believe that the SADMERC has erred in fulfilling any of these primary 
roles as a result of this incident. The SADMERC’ s data is used by many to develop policies, 
facilitate program integrity activities, and to support special initiatives. Further, federal and state 
law enforcement agencies, including the Department of Justice and the Office of the Inspector 
General, have utilized the SADMERC’ s data and reports in both civil and criminal cases, without 
question. The SADMERC is recognized both within CMS and by the DME industry as an expert 
in its analytical and medical coding capabilities. CMS has confidence in the data produced by 
the SADMERC and its staff, and we have no reason to believe the SADMERC has compromised 
any of its day to day operations or work products. 

VII, Conclusion 

CMS thanks the HSGAC PSI staff for their interest in the Medicare program and maintaining its 
integrity. Further, we appreciate the opportunity to provide this feedback on the Subcommittee’s 
preliminary findings. As discussed in this report, based on our review and analysis, we have 
come to the following conclusions: 

• Historically, CMS did not generally require DME suppliers to include ICD-9-CM codes 
with their claims. CMS now requires DME suppliers to include diagnosis codes with 
their claims, and requires its DME claims processing contractors to check these codes, 
but this Medicare requirement is a relatively new one that was put in place during 2003 
and 2004 for the sole purpose of achieving compliance with new healthcare industry-wide 
electronic claims transaction standards (mandated by the Health Insurance Portability and 
Accountability Act). Accordingly, depending on the date a DME claim was processed, 
the claim may, in fact, have been paid without a valid ICD-9 code as defined by the ICD- 
9-CM Manual and, regardless of the ICD-9 code’s validity, it does not necessarily mean 
that the claim was paid inappropriately or that it was processed incorrectly; 

• Based on a claim file review of a sample of the claim lines provided by the PSI staff, it 
appears that most of the claims listed on the SADMERC reports were processed 
appropriately; and 

• The diagnosis description field in the SADMERC reports provided to the PSI staff is not 
accurate or reliable; therefore, it should not be used to conclude whether a claim was paid 
with an invalid diagnosis code. 

Regardless of the ultimate conclusions drawn from the SADMERC data reports under scrutiny, 
CMS welcomes the external interest of the Subcommittee as a means to ensure that our programs 
operate as efficiently as possible and with the highest level of integrity. 


7 
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ADDENDUM A 

Issue: Are DME suppliers required to include ICD-9-CM diagnosis codes on electronic 

and paper claims? If so, when did CMS promulgate this requirement to its 
claims processors and to DME suppliers? For what purpose did CMS 
promulgate the requirement? 


CMS Response 

Historically, CMS did not generally require DME suppliers to include ICD-9-CM codes with 
their claims. Instead, DME suppliers were and continue to be required to maintain a doctor’s 
order in their files for each and every billing. Moreover, for some DME items, suppliers are 
expected to furnish Medicare a certificate of medical necessity signed by the physician to 
document medical necessity. 

There are several reasons why Medicare did not require DME suppliers to submit diagnosis data 
with their claims. First, DME suppliers do not hold clinical licenses, are not qualified to exercise 
clinical judgment, and sometimes have problems obtaining clinical information from the 
patient’s physician. In addition, a physician might order the same kind of DME - e.g., a 
wheelchair - for many different kinds of underlying conditions, and (in these cases) it is not 
effective or cost-effective to try and match the diagnosis to the DME item within the claims 
process. Moreover, the patient’s diagnosis does not affect Medicare’s payment calculation for 
DME. For all of these reasons. Medicare did not and does not generally need these codes on 
DME claims to meet its own internal coverage and payment policy needs. 

CMS now requires DME suppliers to include diagnosis codes with their claims, and requires its 
DME claims processing contractors to check these codes, but this Medicare requirement is a 
relatively new one that was put in place during 2003 and 2004. More specifically, for the sole 
purpose of achieving compliance with new healthcare industry-wide electronic claims transaction 
standards (mandated by HIPAA), CMS did begin to require DME suppliers to include diagnosis 
codes on their claims in recent years. In May 2003, CMS directed DME suppliers to begin 
including these codes on their electronic claims. In October 2003, this mandate was extended to 
DME claims billed on paper. However, due to the newness of this activity, CMS did not 
effectuate rigorous computer systems logic to enforce “valid” ICD-9-CM codes on DME claims 
until June 2004. 

CMS promulgated these mandates in keeping with its understanding of the HIPAA requirements. 
The “implementation guide” governing HIPAA-compliant electronic health transactions seems 
to require that at least one current ICD-9-CM code be entered on all electronic health claims, and 
that all codes that are included be compliant with the current codebook. 

It is important to note, however, that the HIPAA “implementation guide” does not require that a 
health payer actually use any particular required data element, including diagnosis codes, in its 
internal claims processes after it receives the claim. Moreover, the guide does not require that a 
payer analyze, for instance, whether a specific diagnosis code is medically consistent with a 
specific procedure code - this decision is left to the payer. So, the fact that a particular ICD-9- 
CM code is deemed “valid” for HIPAA compliance purposes does not imply that the code is the 
best code, or the only code, that could be used to describe the patient’s condition. HIPAA 
compliance does not automatically confer medical accuracy, and is not equivalent to clinical 
judgment. 

The new computer processes put in place by CMS during 2003 and 2004 only check the ICD-9- 
CM codes on the claim for HIPAA compliance. The DME claims processing contractors review 
the medical necessity of DME items, as well as complete their other claims processing tasks, 
through other processes within their overall claims operation. This includes the review of 
certificates of medical necessity for some DME. Certificates of medical necessity do include 
patient diagnosis codes, but - by Medicare law - only the physician is allowed to enter this data 
on the certificates. 


For a few specific DME items, CMS’s DME claims processing contractors have developed 
specific medical policies to adjudicate these kinds of claims. Some of these medical policies do 
require the presence of specific diagnosis codes on the claim or certificate of medical necessity. 
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In these cases, the DME claims processing contractors have checked and continue to check that 
the required diagnosis code(s) is/are reported. 

It may seem odd, at first blush, that CMS extended the HIPAA requirement to paper claims, 
which are not governed by the HIPAA electronic claims implementation guide. However, 
Medicare does transfer many claims to other payers - for secondary payment - in electronic 
format after Medicare has finished processing the claim. The HIPAA-compliant electronic 
“coordination of benefits” transaction also requires the presence of at least one “valid” diagnosis 
code. Since, in effect, Medicare’s claims process converts a paper claim into electronic format 
for transfer to such other payers, CMS ultimately determined that Medicare needed to require 
that even paper claims have a HIPAA-complaint diagnosis code on them. 

A listing of the medical policies that require specific diagnosis/diagnoses codes is enclosed. 

Also enclosed are copies of the 2003 CMS transmittals that required implementation of ICD-9- 
CM coding for (1) electronic and (2) paper DME claims. The CMS transmittal explaining the 
mid 2004 upgrades to Medicare’s computer systems to better validate the HIPAA compliance of 
ICD-9-CM codes billed on DME claims is also enclosed. 


9 
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ENCLOSURES 

(1) Chronology relating to diagnosis codes, HIPAA, and DME claims. 

(2) List of DME claims processing contractor medical policies, with policies requiring specific 
diagnosis/diagnoses codes annotated. 

(3) CMS Transmittal B-03-028 (Issued April 18, 2003, for May 1, 2003 implementation). 
Requires DME suppliers to include a valid ICD-9-CM code on electronic claims. Note the 
DME supplier is given various options, including exercising its own judgment relative to the 
codebook, in determining the appropriate code in the event that the DME supplier cannot get 
this information from the physician. 

(4) CMS Transmittal B-03-045 (Issued June 6, 2003, for October 1, 2003 implementation). 
Implements the same ICD-9-CM coding requirement for most billers of Part B claims for 
electronic claims and for paper claims. 

(5) CMS Change Request 2956 (Issued December 1 9, 2003, for January 20, 2004, 
implementation). Further implements item #3 above. 

(6) CMS Change Request 3Q50 (Issued February 6, 2004, for July 6, 2004, implementation). 
Directs the maintainer of CMS’s computer systems for processing DME claims to implement 
more rigorous computer logic to block claims with diagnoses codes that are not compliant 
with ICD-9-CM from processing. 

(7) CMS Change Request 3303 (Issued June 1 8, 2004, for October 4, 2004, implementation). 
Directs Medicare contractors to no longer allow providers and suppliers to implement ICD-9- 
CM coding updates as they occur. 


10 
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1979 

04/1989 

08/1996 

08/2000 

01/2001 

2002-3 

05/2003 

10/2003 

10/2003 

10/2003 

07/2004 

07/2004 


CHRONOLOGY 

DIAGNOSIS CODES, HIPAA, and DME CLAIMS 


Hospitals and other institutional providers are required to report ICD-9-CM codes on 
the CMS- 1450 claims form. These codes are not vet required on Medicare Part B 
claims (including DME claims). 

Use of ICD-9-CM codes becomes mandatory for physicians’ services - but not DME 
claims - submitted on the CMS-1 500 claims form. (42 CFR 424.32). 

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public 
Law 104-91) is enacted. Subtitle F of HIPAA requires the HHS Secretary to establish 
a number of standards for electronic data interchange in the healthcare sector, 
including standards for electronic health claims transactions and medical code sets. 

HHS announces that ICD-9-CM codes will serve as the mandatory code set for 
reporting patient diagnosis data within electronic health care transactions. Standards 
for electronic health claims transactions (ANSI XI 2 837) are also established. (45 
CFR 162). The effective date of the regulation is October 16, 2000, with an initial 2- 
year compliance deadline (payers and providers would face penalties if they did not 
comply by October 16, 2002). 

The Administrative Simplification Compliance Act (ASCA) gives health payers and 
health care providers one additional year to comply with the HIPAA-mandated 
electronic claims transaction and code set standards, so long as these entities file a 
plan for achieving compliance with HHS. Hence, ASCA sets a de-facto industry 
compliance deadline of October 16. 2003 . 

Medicare begins to tighten computer systems editing to validate ICD-9-CM codes 
against dates of service, if and when these codes are submitted by DME suppliers. 

Medicare begins requiring DME suppliers to include at least one “valid” ICD-9-CM 
codes on electronic claims. This requirement does not extend to paper claims. (PM- 
B-03-028). 

Medicare achieves HIPAA-compliance and requires the ICD-9-CM code on all 
electronic claims, except ambulance claims. Medicare adopts a “contingency plan” 
that allows a few submitters to temporarily continue using pre-HIPAA electronic 
formats. 

Most providers and suppliers (including DME suppliers) are required to submit 
electronic claims to Medicare. However, in accordance with ASCA, small DME 
suppliers (and some others) are allowed to continue paper billing. 

CMS announces a requirement that contractors reject paper claims that fail to include 
valid ICD-9-CM codes. This requirement apparently extends to DME suppliers (but 
excludes ambulance suppliers). The purpose of the requirement is to ensure that 
Medicare’s “coordination of benefits” transactions meet HIPAA standards. However, 
Medicare’s computer systems enforce the requirement only for primary diagnosis 
codes, and other diagnosis codes that are referenced in claims line item detail. (PM- 
B-03045). 

Medicare implements upgraded “front-end” computer systems logic to reject inbound 
electronic claims, including DME claims, that contain any “invalid” diagnosis codes. 

Systems edits now ensure that electronic DME claims will only process if all 
diagnosis codes on the claim are “valid” - the codes exist in the Codebook and reflect 
the highest level of specificity. These edits do not, of themselves, implement a 
medical policy - that is, the front-end edits do not check for clinical consistency 
between the diagnosis code(s) and the DME supplies billed on the claim. (CMS 
change request #3050). DME suppliers (and other billers) continue to get a 90-day 
“grace period” in using new diagnoses codes as annual coding updates are made. 

As of this date, Medicare’s computer systems are rejecting “invalid” diagnosis codes 
(whether reported in the primary position or otherwise) on electronic DME claims. 

1 1 
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Moreover, the DME claims processing system also validates the primary diagnosis 
billed on paper DME claims, as well as other diagnoses referenced in the line item 
detail of paper DME claims. 

10/2004 CMS stops allowing providers and suppliers a 90-day “grace period” in implementing 
each year’s coding updates. (CMS change request #3303). 

10/2005 Medicare terminates its “contingency plan” for electronic health claims transactions - 
only HIPAA-compliant electronic claims are accepted. 


12 
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MEMORANDUM 


To: David Barnett 

From: Adrian M. Oleck, M.D. 

Date: March 5, 2008 

Subject: DME MAC Medical Policies with ICD-9 Codes 

Attached is the list of DMEPOS policies that identify specific ICD-9 codes that are linked 
to coverage. It should be noted that: 

• In some policies the ICD-9 diagnosis codes relate to all HCPCS codes addressed 
by the policy. In other policies, the ICD-9 codes relate to only some of the 
HCPCS codes in the policy. 

* In some policies, the ICD-9 codes are found in the Local Coverage Determination 
(LCD). In other policies, the ICD-9 codes are found in the related Policy Article. 


13 
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Policy 

ICD-9 Codes 
Specified 

Ankle-Foot and Knee-Ankie-Foot Orthoses 

X 

Automatic External Defibrillators 

X 

Canes and Crutches 


Cervical Traction Devices 


Cold Therapy 


Commodes 


Continuous Positive Airway Pressure (CPAP) Systems 


Enteral Nutrition 


Epoetin 


External Breast Pros'theses 

X 

External Infusion Pumps 

X 

Eye Prostheses 


Facial Prostheses 


Glucose Monitors 

X 

High Frequency Chest Wall Oscillation Devices 

X 

Home Dialysis Supplies and Equipment 


Hospital Beds and Accessories 


immunosuppressive Drugs 

X 

Infrared Heating Pad Systems 


Intrapulmonary Percussive Ventilation System 


Lower Limb Prostheses 


Manual Wheelchair Bases 


Mechanical !n-Exsufftation Devices 

X 

Nebulizers 

X 

Negative Pressure Wound Therapy Pumps 


Oral Anticancer Drugs 

X 

Oral Antiemetic Druqs (Replacement for Intravenous Antiemetics) 

X 

Orthopedic Footwear 

X 

Osteogenesis Stimulators 

X 

Ostomy Supplies 

X 

Oxygen and Oxygen Equipment 


Parenteral Nutrition 


Patient Lifts 


Pneumatic Compression Devices (for Lymphedema) 


Power Mobility Devices 


F>ressure Reducing Support Surfaces, Group 1 


Pressure Reducing Support Surfaces, Group 2 

X 

Pressure Reducing Support Surfaces, Group 3 


Refractive Lenses 

X 

Respiratory Assist Devices 


Seat Lift Mechanisms 


Speech Generating Devices 


Spinal Orthoses: TLSO and LSO 


Suction Pumps 


Surgical Dressings 


Therapeutic Shoes for Diabetics 

X 

Tracheostomy Supplies 

X 

Transcutaneous Electrical Nerve Stimulators (TENS) 


Urological Supplies 


Walkers 


Wheelchair Options and Accessories 


Wheelchair Seating 

X 
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Program Memorandum 

Carriers 

Department of Health & 
Human Services (DHHS) 
Centers for Medicare & 
Medicaid Services (CMS) 

Transmittal B-03-028 

DATE: APRIL 18, 2003 


SUBJECT: Durable Medical Equipment Regional Carriers (DMERC) - ICD-9-CM 
Coding 


Background 

The Centers for Medicare & Medicaid Services (CMS) has issued several instructions on the 
implementation of the 2003 Update to the International Classification of Diseases, 9 th Edition, 

Clinical Modification (ICD-9-CM) diagnosis codes. The ICD-9-CM diagnosis codes were adopted 
under the Health Insurance Portability and Accountability Act (HIPAA) as the medical code set to 
be used for reporting diagnosis in the HIPAA X12N 837 Health Care Claim Transaction. The 
X12N 837 (version 401 0A1) requires a diagnosis on all claims unless there are no diagnoses (i.e., 
taxi claims). Since current CMS policy does not always require a diagnosis on the claim for certain 
services, this Program Memorandum (PM) provides additional guidance to DMERCs in 
implementing the HIPAA XI2N 837 requirement for reporting diagnosis codes. Instructions that 
will address reporting the ICD-9-CM on other carrier claims will be forthcoming. 

Policy 

The physician should code the ICD-9-CM code that provides the highest degree of accuracy and 
completeness. In the past, there has been some confusion about the meaning of “highest degree of 
specificity,” and in “reporting the correct number of digits”. In the context of ICD-9-CM coding, 
the “highest degree of specificity” refers to assigning the most precise ICD-9-CM code that most 
fully explains the narrative description of the symptom or diagnosis. Concerning level of 
specificity, ICD-9-CM codes contain either 3, 4, or 5-digits. If a 3-digit code has 4-digit codes 
which further describe it, then the 3-digit code is not acceptable for claim submission. If a 4-digit 
code has 5-digit codes which further describe it, then the 4-digit code is not acceptable for claim 
submission. 

For electronically submitted claims for durable medical equipment, prosthetics, orthotics, and 
supplies (DMEPOS), a valid diagnosis code, which most fully explains the patient’s diagnosis, is 
required. CMS understands that physicians may not always provide suppliers of DMEPOS with the 
most specific diagnosis code, and may provide only a narrative description. In those cases, suppliers 
may choose to utilize a variety of sources to determine the most specific diagnosis code to include 
on the individual line items of the claim. (Suppliers are precluded from including diagnostic 
information on a certificate of medical necessity per §1 842(j)(2)(a) of the Social Security Act.) 

These sources may include, but are not limited to: coding books and resources, contact with 
physicians or other health professionals, documentation contained in the patient’s medical record, or 
verbally from the patient’s physician or other healthcare professional. 

Listed below is specific information about claims submission: 

a) All electronic claims submitted to the DMERC must contain a valid diagnosis code for 
each line item on the claim. 

b) Electronic claims (assigned or unassigned) without an ICD-9-CM code(s) shall be 
returned as front end rejects to the supplier. These claims do not get in the front door. 

c) For all claims with an ICD-9-CM code, a valid ICD-9-CM code (the code that provides 
the highest level of specificity for the date the service was provided) must be used. 

CMS-Pub. 60B 
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d) Assigned claims with an invalid ICD-9-CM code shall be returned as unprocessable and 
unassigned claims shall be denied for incorrect coding. (NOTE: It DMERCs are 
currently developing these unassigned claims prior to denial, they may continue to do 
so.) 

e) Paper claims require an ICD-9-CM code if specified (e.g., required by a local medical 
review policy (LmRP}). However, if an ICD-9-CM code is required, the code will go 
through the same accuracy edits as electronic claims. 

The DMERCs shall not deny claims where the diagnosis code on a claim does not match the 
diagnosis on the order or a certificate of medical necessity (CMN), so long as: 1 ) There is sufficient 
evidence in the patient’s medical record to justify the use of the diagnosis code, 2) The diagnosis on 
the claim justifies coverage for the item or service, and 3) The diagnosis code on the claim is valid 
and to the highest level of specificity. 

In addition, DMERCs shall not require suppliers to obtain new orders or CMNs in those cases 
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where ICD-9-CM codes were updated unless normal business practices would require a new order 
or CMN. For instance, suppliers are required to obtain new orders and/or CMNs when the patient’s 
medical condition changes. If an ICD-9-CM code is updated, and the patient’s medical condition 
has not changed, there is no requirement for the supplier to obtain a new order and/or CMN. 

Provider Education: 

Educate suppliers on the above instructions on your Web sites, next regularly scheduled bulletin, 
training sessions, and listservs. 

The effective date for this PM is May 1, 2003. 

The implementation date for this PM is May 1, 2003. 

These instructions should be implemented within your current operating budget. 

This PM may be discarded after April 1, 2004. 

If you have any questions, contact your Regional Office. 


16 
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Program Memorandum 

Carriers 

Department of Health & 
Human Services (DHHS) 
Centers for Medicare & 
Medicaid Services (CMS) 

¥ransmittaf 8-63-04$ 

Date: JUNE 6, 2003 


CHANGE REQUEST 2725 

SUBJECT: ICD-9-CM Coding Requirements for Claims Submitted to Medicare Carriers 

I. GENERAL INFORMATION 

A. Background: 


This Program Memorandum (PM) implements a new policy to require an ICD-9-CM 
diagnosis code on all paper and electronic claims billed to carriers with the exception of 
ambulance claims (specialty type 59). 


In accordance with the Health Insurance Portability and Accountability Act (HIPAA), a 
final rule published in the Federal Register on August 17, 2000 established new 
standards, requirements, and implementation specifications for health plans, health care 
clearing houses, and health care providers who transmit any health information in an 
electronic form. The applicable electronic format for transmitting Medicare claims 
information is the ASC X12N 837. The implementation specifications define the new 
requirements for these formats. The ASC X12N 837 Professional Implementation Guide 
(version 4010A.1) requires a diagnosis(es) on “all claims/encounters except claims for 
which there are no diagnoses (e.g., taxi claims).” 

This PM clarifies that based upon the implementation specifications for HIPAA, an ICD- 
9-CM code is not required for all ambulance supplier claims, but is required for all other 
professional claims e.g., physicians, non-physician practitioners, independent clinical 
diagnostic laboratories, occupational and physical therapists, independent diagnostic 
testing facilities, audiologist, and ASCs. Although the HIPAA requirements do not apply 
to paper claims, you are to implement the ICD-9-CM requirement for paper claims as 
well as all electronic claims, regardless of the version of the electronic claim format. 

Emergency medical technicians (EMTs) and paramedics use a trip sheet to document the 
condition of the beneficiary, including the patient’s chief complaints, at the time that the 
beneficiary is loaded onto the ambulance. This documentation may later be requested by 
the intermediary/carrier during medical review of the claim for use in determining 
whether the ambulance transport and services provided were medically necessary. 

However, EMTs and paramedics do not have the training necessary to make a diagnosis. 
Thus, no diagnosis is available at the time of transport. Moreover, it is the condition of 
the beneficiary at the time of transport, rather than the beneficiary’s diagnosis, that 
determines whether the transport and services provided are payable under the Medicare 
ambulance benefit. 

B. Policy: 

A diagnosis code must be included on all Medicare claims (electronic and paper) 
submitted to Part B carriers, except those claims submitted by ambulance suppliers. 
Professional suppliers of service include: physicians, non-physician practitioners, 
independent clinical diagnostic laboratories, occupational and physical therapists, 
independent diagnostic testing facilities, audiologist, and ASCs. 


CMS-Pub. 60B 

The claim should contain the ICD-9-CM code that provides the highest degree of 
accuracy and completeness. In the past, there has been some confusion about the 
meaning of “highest degree of specificity,” and in “reporting the correct number of 
digits”. In the context of ICD-9-CM coding, the “highest degree of specificity” refers 
to assigning the most precise ICD-9-CM code that most fully explains the narrative 
description of the symptom or diagnosis. Concerning level or specificity, ICD-9-CM 
codes contain either 3, 4, or 5-digits. If a 3-digit code has 4-digit codes which further 
describe it, then the 3 -digit code is not acceptable for claim submission. If a 4-digit 
code has 5 -digit codes which further describe it, then the 4-digit code is not acceptable 
for claim submission. 

C, Implementation : 

Editing of Claims Submitted to Carriers for the Presence of a Diagnosis Code 

Effective for dates of service on or after October 1, 2003, all paper and electronic claims 
submitted to carriers must contain a valid diagnosis code with the exception of claims 
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submitted by ambulance suppliers (specialty type 59). Carriers must return as 
unprocessable, paper and electronic claims that do not contain a valid diagnosis code with 
the exception or claims submitted by ambulance suppliers (specialty type 59). 

Program Memorandum B-03-028, Change Request 2672, implemented requirements for 
submittal of a diagnosis for electronic claims processed by durable medical equipment 
regional carriers. This PM expands the requirements for submittal of the diagnosis 
required in PM B-03-028 to include paper claims. 

If any carriers are currently placing invalid or valid diagnosis codes on any claims prior 
to sending the claim to CWF and their coordination-of-benefits trading partners, they 
must discontinue this practice. 

Carriers and CWF must not reject an ambulance claim on the basis that it does not 
contain a diagnosis code. 

Physicians Reporting Diagnosis Codes When A Diagnostic Test Is Ordered 

Section 4317 of the Balanced Budget Act of 1 997 provides, with respect to diagnostic 
laboratory and certain other services, that “if the Secretary (or fiscal agent of the 
Secretary) requires the entity furnishing the services to provide diagnostic or other 
medical information to the entity, the physician or practitioner ordering the service shall 
provide that information to the entity at the time the service is ordered by the physician or 
practitioner.” A laboratory or otner provider must report on a claim for Medicare 
payment the diagnostic codefs) furnished by the ordering physician. In the absence of 
such coding information, the laboratory or other provider may determine the appropriate 
diagnostic code based on the ordering physician’s narrative diagnostic statement or seek 
diagnostic information from the ordering physician/practitioner. However, a laboratory 
or other provider may not report on a claim for Medicare payment a diagnosis code in the 
absence of physician-supplied diagnostic information supporting such code. 

Provider Education 


Carriers must notify suppliers of these changes through your Web sites within two weeks 
of receipt and publish the information in your next regularly scheduled bulletin. In 
addition, if you have a listserv that targets the affected provider communities, you shall 
use it to notify subscribers that important information about “ICD-9-CM Coding 
Requirements” is available on your Web site. The CMS will publish a national provider 
education article shortly that addresses these guidelines. 

II BUSINESS REQUIREMENTS 


Requirement # 

Requirements 

Responsibility 

i.i 

Carriers must return paper and electronic claims as 
unprocessable from all specialty types except “59” that 
does not have a diagnosis code(s) on the claim. 

Carriers 

1.2 

Carriers may not return as unprocessable a paper or 
electronic claim for an ambulance service (specialty type 

59) because the claim has no diagnosis code. 

Carriers 

1.3 

CWF may not reject an ambulance service claim (specialty 
type 59) because the claim has no diagnosis code. 

Common 

Working File 

1.4 

Carriers must not enter a diagnosis code (valid or invalid) 
on any claim type. 

Carriers 


III SUPPORTING INFORMATION AND POSSIBLE DESIGN CONSIDERATIONS 
A. Other Instructions: 


X-Ref Requirement # 

Instructions 




B, Design Considerations: 


X-Ref Requirement # 1 

Recommendation for Medicare System Requirements 




C, Interfaces: 
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D. Contractor Financial ReportingAVorkload Impact: 

E. Dependencies: 

F. Testing Considerations: 

IV. ATTACHMENT (S) 


Version: 

Implementation Date: October 1, 2003 

Discard Date: October 1, 2004 

Post-Implementation Contact: regional 
offices 


Effective Date: October 1, 2003 

Funding: These instructions should be 
implemented within your current operating 
budget. 

Pre-Implementation Contact: If you have any 
questions, contact your regional office. 
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CMS Manual System 

Pub. 100-04 Medicare Claims Processing 

Department of Health & 
Human Sendees (DHHS) 
Centers for Medicare & 
Medicaid Services (CMS) 

Transmittal 47 

Date: DECEMBER 19, 2003 


CHANGE REQUEST 2956 


I. SUMMARY OF CHANGES: This instruction manualizes the return as unprocessable 
requirements concerning ICD-9-CM diagnosis coding for Medicare Part B claims previously 
released in Program Memorandum Transmittal B-03-045, Change Request (CR) 2725, dated June 
6, 2003. Chapter 1 , section 80.3.2.1.1 is revised to include a sentence stating that the requirements 
are in addition to requirements established under the Health Insurance Portability and 
Accountability Act of 1996 (HIPAA). Chapter 1, section 80.3.2.1.3 subparagraph p. is deleted and 
following subparagraphs redesignated accordingly. 

NOTE: Chapter 26, Completing and Processing Form CMS- 1500 Data Set, of the Medicare 
Claims Processing Manual will further incorporate the provisions of CR 2725 when that chapter 
is next revised. 

NEW/REVISED MATERIAL-EFFECTIVE DATE: October 1, 2003 

IMPLEMENTATION DATE: January 20, 2004 

Disclaimer for manual changes only: The revision date and transmittal number apply only to 
red italicized material. Any other material was previously published and remains unchanged. 

II. CHANGES IN MANUAL INSTRUCTIONS: (R = REVISED, N = NEW, D « 
DELETED) 


R/N/D 

CHAPTER/SECTION/SUBSECTION/TITLE 

R 

1/80.3.2.1.1/Carrier Data Element Requirements 

R 

1/80.3.2.1. 3/Carrier Specific Requirements for Certain Specialties/Services 


III. FUNDING: Medicare contractors only: 

These instructions should be implemented within your current operating budget. 

IV. ATTACHMENTS: 



Business Requirements 

X 

Manual Instruction 


Confidential Requirements 


One-Time Notification 
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Business Requirements 

1 Pub, 100-04 Transmittal: 47 j Date: December 19, 2003 [ Change Request 29561 
I. GENERAL INFORMATION 

A. Background: The Medicare Carriers Manual return as unprocessable instructions had 
provided in two subparagraphs that claims for physician and nonphysician specialty claims, and 
for other services where required, must submit diagnosis code(s) in item 21 of the CMS- 1500 
claim form or electronic equi valent. If the code(s) was missing, incorrect, or truncated, the claim 
was to be returned by the carrier as unprocessable. Change Request (CR) 2725, Transmittal B- 
03-045, June 6, 2003 requires that valid diagnosis code(s) must be submitted for all claims with 
the exception of claims submitted by ambulance suppliers. Thus, CR 2725 had expanded the 
types of services where valid diagnosis codes were required on claims. 

B. Policy: Effective for claims with dates of service on or after October 1, 2003, carriers must 
return Form CMS- 1 500 paper claims or electronic equivalent claims as unprocessable where a 
claim is required to have ICD-9-CM diagnosis code(s) on the claim but required diagnosis 
code(s) are not entered on the claim. This policy was set forth in CR 2725. 

C. Provider Education: None 

//. BUSINESS REQUIREMENTS 
“Shall" denotes a mandatory requirement 
"Should" denotes an optional requirement 


Requirement # 

Requirements 

Responsibility 

i 

Carriers shall return paper and electronic claims 
with dates of service on or after October 1 , 

2003 as unprocessable for all specialty types 
that require diagnosis code(s) on the claim 
where the claim does not have valid diagnosis 
code(s). All specialty types except 59, 
ambulance, require diagnosis code(s) on the 
claim. 

Carrier 


III SUPPORTING INFORMA TION AND POSSIBLE DESIGN CONSIDER A TIONS 


A. Other Instructions: N/A 


X-Ref Requirement # 

Instructions 




B. Design Considerations: N/A 


X-Ref Requirement # 

Recommendation for Medicare System Requirements 




C. Interfaces: N/A 

D. Contractor Financial Reporting /Workload Impact: N/A 

E. Dependencies: N/A 

F. Testing Considerations: N/A 
IV OTHER CHANGES: N/A 


Citation 

Change 
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V. SCHEDULE, CONTACTS, AND FUNDING 


Effective Date: October 1, 2003 
Implementation Date: January 20, 2004 

Pre-Implementation Contaet(s): appropriate 
CMS regional office 

Post-Implementation Contacts): Appropriate 
regional offiee 


These instructions should be 
implemented within your 
current operating budget 
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80.3.2.1.1 - Carrier Data Element Requirements 
(Rev. 47, 12-19-03) 

B3-3005.4 

A - Required Data Element Requirements 
1 - Paper Claims 

The following instruction describes certain data element formatting requirements to be followed 
when reporting the calendar year date for the identified items on the Form CMS- 1500: 

• If birth dates are furnished in the items stipulated below, then these items must contain 8- 
digit birth dates (MMDDCCYY). This includes 2-digit months (MM) and days (DD), 
and 4-digit years (CCYY). 

Form CMS-1500 Items Affected by These Reporting Requirements: 

Item 3 - Patient’s Birth Date 

Item 9b - Other Insured’s Date of Birth 

Item 1 la - Insured’s Date of Birth 

Note that 8-digit birth dates, when provided, must be reported with a space between month, day, 
and year (i.e., MM_DD_CCYY). On the Form CMS- 1500, the space between month, day, and 
year is delineated by a dotted, vertical line. 

If a birth date is provided in items 3, 9b, or 1 la, and is not in 8-digit format, carriers must return 
the claim as unprocessable. They use remark code MA 52 on the remittance advice. For formats 
other than the remittance, use code(s)/messages that are consistent with the above remark codes. 
If carriers do not currently edit for birth date items because they obtain the information from 
other sources, they are not required to return these claims if a birth date is reported in items 3, 9b, 
or 11a. and the birth date is not in 8-digit format. However, if carriers use date of birth 
information on the incoming claim for processing, they must edit and return claims that contain 
birth date(s) in any of these items that are not in 8-digit format. 

For certain other Form CMS-1500 conditional or required date items (items lib, 14, 16, 18, 19, 
or 24a), when dates are provided, either a 6-digit date or 8-digit date may be provided. 

If 8-digit dates are furnished for any of items 1 lb, 14, 16, 18, 19, or 24a (excluding items 12 and 
31), carriers must note the following: 

• All completed date items, except item 24a, must be reported with a space between month, 
day, and year (i.e., MM_DD_CCYY). On the Form CMS-1500, the space between 
month, day, and year is delineated by a dotted, vertical line; 

• Item 24a must be reported as one continuous number (i.e., MMDDCCYY), without any 
spaces between month, day, and year. By entering a continuous number, the date(s) in 
item 24a will penetrate the dotted, vertical lines used to separate month, day, and year. 
Carrier claims processing systems will be able to process the claim if the date penetrates 
these vertical lines. However, all 8-digit dates reported must stay within the confines of 
item 24a; 

• Do not compress or change the font of the “year” item in item 24a to keep the date within 
the confines of item 24a. If a continuous number is furnished in item 24a with no spaces 
between month, day, and year, you will not need to compress the “year” item to remain 
within the confines of item 24a; 

• The “from” date in item 24a must not run into the “to” date item, and the “to” date must 
not run into item 24b; 

• Dates reported in item 24a must not be reported with a slash between month, day, and 
year; and 

• If the provider of service or supplier decides to enter 8-digit dates for any of items 1 1 b, 

14, 16, 18, 19, or 24a (excluding items 12 and 31), an 8-digit date must be furnished for 
all completed items. For instance, you cannot enter 8-digit dates for items lib, 14, 16, 

1 8, 19 (excluding items 12 or 31), and a 6-digit date for item 24a. The same applies to 
those who wish to submit 6-digit dates for any of these items. 

Carriers must return claims as unprocessable if they do not adhere to these requirements. 

2 - Electronic Claims 

Carriers must return all electronic claims that do not include an 8 -digit date (CCYYMMDD) 
when a date is reported. They use remark code MA52 on the remittance advice. For formats 
other than the remittance, carriers use code(s)/message(s) that are consistent with the above 
remark codes. 

If carriers do not currently edit for birth date items because they obtain the information from 
other sources, they are not required to return these claims if a birth date is reported in items 3, 9b, 
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or 1 la and the birth date is not in 8 -digit format. However, if carriers do use date of birth 
information on the incoming claim for processing, they must edit and return claims that contain 
birth date(s) in any of these items that are not in 8-digit format. 

B - Required Data Element Requirements 

The following Medicare-specific, return as unprocessable requirements in this section and the 
following two sections are in addition to requirements established under the Health Insurance 
Portability and Accountability Act of 1996 (HJPAA). 

Carriers must return a claim as unprocessable to a provider of service or supplier and use the 
indicated remark codes if the claim is returned through the remittance advice or notice process. 

In most cases, reason code 16, Claim/service lacks information that is needed for adjudication, 
will be used in tandem with the appropriate remark code that specifies the missing information. 
Carriers use the following: 

1 . If a claim lacks a valid Medicare Health Insurance Claim Number (HICN) in item 1 A or 
contains an invalid HICN in item 1A. (Remark code MA61.) 

2. If a claim lacks a valid patient’s last and first name as seen on the patient’s Medicare card or 
contains an invalid patient’s last and first name as seen on the patient’s Medicare card. 
(Remark code MA36.) 

3. If a claim does not indicate in item 1 1 whether or not a primary insurer to Medicare exists. 
(Remark code MA83 or MA92.) 

4. If a claim lacks a valid patient or authorized person’s signature in item 12 or contains an 
invalid patient or authorized person’s signature in item 12. (See “Exceptions,” bullet number 
one. Remark code MA75.) 

5. If a claim lacks a valid “from” date of service in item 24A or contains an invalid “from” date 
of service in item 24A. (Remark code M52.) 

6. If a claim lacks a valid place of service (POS) code in item 24b, or contains an invalid POS 
in item 24b, return the claim as unprocessable to the provider or supplier, using RA remark 
code M77. Effective for claims received on or after April 1, 2004, on the Form CMS- 1500, 
if a claim contains more than one POS (other than Home - 12), for services paid under the 
MPFS and anesthesia services. 

7. If a claim lacks a valid procedure or HCPCS code (including Levels 1-3, “unlisted procedure 
codes,” and “not otherwise classified” codes) in item 24D or contains an invalid or obsolete 
procedure or HCPCS code (including Levels 1-3, “unlisted procedure codes,” and “not 
otherwise classified” codes) in item 24D. (Remark code M20 if the HCPCS is missing, or 
M51 for an invalid/obsolete HCPCS.) 

Note: Level 3 HCPCS will be going away with HIPAA. 

8. If a claim lacks a charge for each listed service. (Remark code M79.) 

9. If a claim does not indicate at least one day or unit in item 24G (Note: To avoid returning the 
claim as “unprocessable” when the information in this item is missing, the FI must program 
the system to automatically default to “1” unit ). 

10. If a claim lacks a signature from a provider of service or supplier, or their representative. 

(See “Exceptions,” bullet number one; Remark code MA70 for a missing provider 
representative signature, or code MA81 for a missing physician/supplier/practitioner 
signature.) 

1 1. If a claim does not contain in item 33: 

a. A billing name, address, ZIP code, and telephone number of a provider of service or 
supplier. (Remark code MA82.) 

AND EITHER 

b. A valid PIN (or NPI when effective) number or, for DMERC claims, a valid National 
Supplier Clearinghouse number for the performing provider of service or supplier 
who is not a member of a group practice. (Remark code MA82 or M57 if another 
provider is involved.) 

OR 

c. A valid group PIN (or NPI when effective) number or, for DMERC claims, a valid 
National Supplier Clearinghouse number for performing providers of service or 
suppliers who are members of a group practice. (Remark code MAI 12.) 
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80.3.2.1.3 - Carrier Specific Requirements for Certain Specialties/Services 

(Rev.47, 12-19-03) 

Carriers must return the following claim as unprocessable to the provider of service/suppiier: 

a. For chiropractor claims: 

1 . If the x-ray date is not entered in item 1 9 for claims with dates of service prior to 
January 1, 2000. Entry of an x-ray date is not required for claims with dates of service on 
or after January 1, 2000. 

2. If the initial date “actual” treatment occurred is not entered in item 14. (Remark code 
MAI 22 is used.) 

b. For certified registered nurse anesthetist (CRNA) and anesthesia assistant (AA) claims, if the 
CRNA or AA is employed by a group (such as a hospital, physician, or ASC) and the group’s 
name, address, ZIP code, and PIN (or NPI when effective) number is not entered in item 33 
or their personal PIN (or NPI number when effective) is not entered in item 24K. (Remark 
code MAI 12 is used.) 

c. For durable medical, orthotic, and prosthetic claims, if the name, address, and ZIP code of the 
location where the order was accepted were not entered in item 32. (Remark code MA 1 14 is 
used.) 

d. For physicians who maintain dialysis patients and receive a monthly capitation payment: 

1 , If the physician is a member of a professional corporation, similar group, or clinic, 
and the attending physician’s PIN (or NPI when effective) is not entered in item 24K. 
(Remark code MAI 12 is used.) 

2. If the name, address, and ZIP code of the facility other than the patient’s home or 
physician’s office involved with the patient’s maintenance of care and training is not 
entered in item 32. (Remark code MAI 14 is used.) Effective for claims received on 
or after April 1, 2004, the name, address, and ZIP code of the service location for all 
services other than those furnished in place of service home - 12 must be entered. 

e. For routine foot care claims, if the date the patient was last seen and the attending physician’s 
PIN (or NPI when effective) is not present in item 19. (Remark code MAI 04 is used.) 

f. For immunosuppressive drug claims, if a referring/ordering physician, physician’s assistant, 
nurse practitioner, clinical nurse specialist was used and their name and/or UPIN (or NPI 
when effective) is not present in items 17 or 17A. (Remark code M33 or MA102 is used.) 

g. For all laboratory services, if the services of a referring/ordering physician, physician’s 
assistant, nurse practitioner, clinical nurse specialist are used and his or her name and/or 
UPIN (or NPI when effective) is not present in items 17 or 17A. (Remark code M33 or 
MAI 02 is used.) 

h. For laboratory services performed by a participating hospital-leased laboratory or 
independent laboratory in a hospital, clinic, laboratory, or facility other the patient’s home or 
physician’s office (including services to a patient in an institution), if the name, address, and 
ZIP code of the location where services were performed is not entered in item 32. (Remark 
code MAI 14 is used.) Effective for claims received on or after April 1, 2004, the name, 
address, and ZIP code of the service location for all services other than those furnished in 
place of service home - 1 2 must be entered. 

i. For independent laboratory claims: 

1 . Involving EKG tracing and the procurement of specimen(s) from a patient at home or 
in an institution, if the claim does not contain a validation from the prescribing 
physician that any laboratory service(s) performed were conducted at home or in an 
institution by entering the appropriate annotation in item 19 (i.e., “Homebound”). 
(Remark code MAI 16 is used.) 

2. If the name, address, and ZIP code where the test was performed is not entered in 
item 32, if the services were performed in a location other than the patient’s home or 
physician’s office. (Remark code MAI 14 is used.) Effective for claims received on 
or after April 1 , 2004, the name, address, and ZIP code of the service location for all 
services other than those furnished in place of service home - 12 must be entered. 

j. For mammography “diagnostic” and “screening” claims, if a qualified screening center does 
not accurately enter their 6-digit, FDA-approved certification number in item 32 when billing 
the technical or global component. (Remark code MA128 is used.) 

k. For parenteral and enteral nutrition claims, if the services of an ordering/referring physician, 
physician assistant, nurse practitioner, clinical nurse specialist are used and their name and/or 
UPIN (or NPI when effective) is not present in items 17 or 1 7 A. (Remark code MAI 02 is 
used.) 

l. For portable x-ray services claims, if the ordering physician, physician assistant, nurse 
practitioner, clinical nurse specialist’s name, and/or UPIN (or NPI when effective) are not 
entered in items 17 or 17 A. (Remark code MAI 02 is used.) 
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m. For radiology and pathology claims for hospital inpatients, if the referring/ordering 
physician, physician assistant, nurse practitioner, clinical nurse specialist’s name, and/or 
UPIN (or NPI when effective) if appropriate are not entered in items 17 or 17A. (Remark 
code MAI 02 is used.) 

n. For outpatient services provided by a qualified, independent physical, or occupational 
therapist: 

1 , If the UPIN (or NPI when effective) of the attending physician is not present in item 
19. (Remark code MAI 04 is used.) 

2. If the 6-digit (MM J DD | YY) or 8-digit (MM | DD | CCYY) date patient was last 
seen by the attending physician is not present in item 19. (Remark code MAI 04 is 
used.) 

o. For all laboratory work performed outside a physician’s office, if the claim does not contain a 
name, address, and ZIP code, and PIN (or NPI when effective) where the laboratory services 
were performed in item 32, if the services were performed at a location other than the place 
of service home - 12. (Use Remark code MAI 14.) 

p. For all physician office laboratory claims, if a 10-digit CLIA laboratory identification 
number is not present in item 23. This requirement applies to claims for services performed 
on or after January 1, 1998. (Remark code MA51 is used.) 

q. For investigational devices billed in an FDA-approved clinical trial if an Investigational 
Device Exemption (IDE) number is not present in item 23. (Remark code MA50 is used.) 

r. For physicians performing care plan oversight services if the 6-digit Medicare provider 
number of the home health agency (HHA) or hospice is not present in item 23. (Remark 
code MA49 is used.) 
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Related Change Request (CR) #: 3050 MLN Matters Humber: MVB050 

Related CR Release Date: February 6, 2004 

Related CR Transmittal #: R8SCP 

Effective Date: July 1, 2004 

Implementation Date: July 6, 2004 

Health Insurance Portability and Accountability Act (HPAA) X12N 837 Professional 
Health Care Claim Implementation Guide (IG) Editing 

■ tsa rs i 1 I at - r ! 'I to vile 

show they are now MLN Matter;: amfe;. Ail other information remains the same. 


Provider Types Affected 

Phyarians,praditioners,suppliers, and providers who bill Wbdicare carriers, including Durable (Vfedical 
Equipment Carriers (DMERCs). 


Provider Action Weeded 



STOP -Impact to You 

Affected providers should stop submitting electronic daims with diagnosis codes, zip 
codes, or telephone numbersthat are not HIPAA compliant. 

CMMVHI - Wk« You l»«f t « 

Providers should note that Medicare systemsare strengthening their systemeditsto 
assure receipt of HIPAA oorrpliant claims. Bfedive July 1, 2004, Nfedicare will 
reject electronic claimsthat have diagnosis codes, zip codes, or telephone numbers 
that are not HIPAA compliant. 

GO - What You Need to Do 

Be sure your billing systems are modified to generate electronic claimsthat will pass 
Medicare's HIPAA compliancy edits for diagnosis codes, zip codes, and telephone 
numbers. 


Background 

The Health Insurance Portability and Accountability Ad (HIPAA) directed the Secretary of the Department 
of Health and Human Services (HHS) to adopt standards fortransadionsto enable health information to be 
exchanged electronically. In addition, one of the HIPAA provisions requires standard formats to be used for 
electronically submitted health care transactions. 


Ds dsim«f 

WBfftpirwl so aaetvbe *> lit public and is tudhtsmkd *> yunlriglrti or impost tbl^-fcna, THaarMimay cardan refrtnces « this t K^ibfan^ «r olitr 

pdkymatriab. Thainrfcrmrian preuded a only infcndedi* tea gentralautimarr. Knnolirrfenifcd'fe -tt* fit place si eifitf fit wittui fewer regJafcna 11* encourage wadersi? 
review tie ^eafcsfctoia/egufefomBndof'iennfcrffeiMtmairidsIwB fiiand a-MifafcsfcfemenioffiarwmfcrTb, 
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Related Change Request #: 3050 MLN Matters Number: MM3050 


CMS is committed to irrpiemeriting the $37 COB transaction set per the Hi PAA implementation guide (16), 
and it recognizes that a change in its systems is needed to: 

1) Comply with the $37 Professional 16; and 

2) To allow the creation of compliant coordination of benefits (COB) daimfiles. 

To accomplish this, {yfedicare systems will be changed to indude edits that reject electronic daimsthat 
contain: 

* Invalid diagnosis codes; 

* A dash, a space, or special character in any zip code field; and 

* A dash, space, special charader, or a parenthesis in telephone numbers. 

implementation 

July 6, 2004. 

Related Instructions 

Hie ANSI XI 2N $37 implementation guides are the standards erf compliance for claim transactions and are 
available eledronically at h ftp JAMw.wpc-ed i.comih ipaa'HIPMJ Oasp on i he CMS web site. 

The Medea® Claims Processing Manual Chapter 24 has been up dated to include the new Section 40.7.2 
Professional implementation Guide (!G) Edits. This new section is induded below: 

40.72 - X12N837 Professional tnplememation Guide (JG> Edits 

The Part B Carriers and Durable Medical Equipment Regional Contractors 0M£RCs) must 

reject inbound electronic claims that contain invalid diagnosis codes whether pointed to or 

not. 

The Part B Carriers and Durable Medical Equipment Regional Contractors (DMERCs) must 
reject inbound electronic claims that contain a dash, space, or special character in any zip 
code. 

The Pan B Carriers and Durable Medical Equipment Regional Contractors (DMERCs) must 
reject inbound electronic claims that contain dashes, spaces, special characters or 
parentheses in any telephone number. 


QsdiiriKt 

DiOBrfck ms prepared mi *ni<* fetrepikljcand o nst'ntedel fcsrentri^rfc«r hrp<ee «NI$»tom.Tlrb retde mi* carter refereo;a*r think ibiite, rejirhfeio,*r*lier 
pdkymithha Ththfcm» , fonpr»Udt<J hardy iirkwMk Ire agential sumimi*. HisnothfcnMkklre fie p4»otof«tierk« «Lriknli»uorrt5Mbfc'>s k 

wi# *k ^«ifcsteifc| rejiiilcnsind «t*rhtepreire irwkiklsfo i iiland Korret *htmtn»«fktr anti* 
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CMS Manual System 

Pub. 100-04 Medicare Claims Processing 

Department of Health & 
Human Services (DHHS) 
Centers for Medicare & 
Medicaid Services (CMS) 

Transmittal 210 

Date: JUNE 18, 2004 


CHANGE REQUEST 3303 


I. SUMMARY OF CHANGES: This instruction is CMS’ annual reminder to the contractors 
of the ICD-9-CM update that is effective for the dates of service on and after October 1 , 2004, as 
well as discharges on or after October 1, 2004 for institutional providers. 

NEW/REVISED MATERIAL - EFFECTIVE DATE: October 1, 2004 

‘IMPLEMENTATION DATE: October 4, 2004 

Disclaimer for manual changes only: The revision date and transmittal number apply to the red 
italicized material only. Any other material was previously published and remains unchanged. 
However, if this revision contains a table of contents, you will receive the new/revised 
information only, and not the entire table of contents. 

II. CHANGES IN MANUAL INSTRUCTIONS: 

(R - REVISED, N - NEW, D = DELETED) 


R/N/D 

CHAPTER/SECTION/SUBSECTION/TITLE 

R 

23/10.2 Relationship of ICD-9-CM Codes and Date of Service 








*111. FUNDING: 

These instructions shall be implemented within your current operating budget. 
IV. ATTACHMENTS: 


X 

Business Requirements 

X 

Manual Instruction 


Confidential Requirements 


One-Time Notification 


Recurring Update Notification 


‘Medicare contractors only 
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Attachment - Business Requirements 

| Pub. 100-04 j Transmittal: 210 j Date: June 18, 2004 j Change Request 3303~1 

SUBJECT: Medicare Contractor Annual Update of the International Classification of 
Diseases, Ninth Revision, Clinical Modification (ICD-9-CM) 


I. GENERAL INFORMATION 

A. Background: In 1979, use of ICD-9-CM codes became mandatory for reporting provider 
services on Form CMS- 1450. On April 1, 1989, use of ICD-9-CM codes became mandatory for 
all physician services submitted on Form CMS- 1500. Effective October 1, 2003 (refer to 
Transmittal B-03-045, dated June 6, 2003) an ICD-9-CM code is required on all paper and 
electronic claims billed to Medicare carriers with the exception of ambulance claims (specialty 
type 59). 

Effective for dates of service on and after October 1, 2004, CMS will no longer provide a 90-day 
grace period for providers (billing carriers/DMERCs) to use in billing discontinued ICD-9-CM 
diagnosis codes on Medicare claims. Institutional providers did not have a grace period, they 
were always required to bill the new ICD-9-CM codes for discharges on or after October 1 . 

The ICD-9-CM codes are updated annually. The CMS sends the ICD-9-CM Addendum out to 
the regional offices and Medicare contractors annually. 

B. Policy: This instruction serves as a reminder to contractors regarding the annual ICD-9- 
CM coding update to be effective for dates of service on or after October 1 , 2004 (effective for 
discharges on or after October 1, 2004 for institutional providers). 

An ICD-9-CM code is required for all professional claims, e.g., physicians, non-physician 
practitioners, independent clinical diagnostic laboratories, occupational and physical therapists, 
independent diagnostic testing facilities, audiologist, ambulatory surgical centers (ASCs), and for 
all institutional claims. However, an ICD-9-CM code is not required for ambulance supplier 
claims. 

The CMS posts the new, revised, and discontinued ICD-9-CM diagnosis codes on the CMS Web 
site at www.cms.hhs. gov/medleam/icd9code,asp on an annual basis. The updated diagnosis 
codes are effective for dates of service on and after October 1. Providers can view the new 
updated codes at this site in June. Providers can also visit the National Center for Health 
Statistics (NCHS) Web site at www.cdc.gov/nchs/icd9.htm . The NCHS will post the new ICD- 
9~CM Addendum on their Web in June. Providers are also encouraged to purchase a new ICD- 
9-CM book or CD-ROM on an annual basis. 

C. Provider Education: A provider education article related to this instruction will be 
available at http://www.cms.hhs.gov/medleam/matters shortly after the CR is released. You will 
receive notification of the article release via the established "medleam matters' 1 iistserv. 
Contractors shall post this article, or a direct link to this article, on their Web site and include 
information about it in a Iistserv message within 1 week of the availability of the provider 
education article. In addition, the provider education article must be included in your next 
regularly scheduled bulletin. 
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II. BUSINESS REQUIREMENTS 


“Shall” denotes a mandatory requirement 
"Should” denotes an optional requirement 


Requirement # 

Requirements 

Responsibility 

3303.1 

Carriers/DMERCs shall accept the new and revised 
2004 ICD-9-CM update in order to process claims 
with dates of service on or after October 1 , 2004. 
NOTE: Reminder Medicare carriers/DMERCs can 
no longer provide a 90-day grace period for 
providers to use in billing discontinued ICD-9-CM 
diagnosis codes. 

Local Part B 
carrier and 
DMERCs 

3303.2 

FISS shall install and FIs shall accept the new and 
revised 2004 ICD-9-CM update in order to process 
claims with dates of service on or after October 1 , 
2004 for outpatient claims and for inpatient claims, 
with discharges on or after October 1, 2004. 

FI, FISS 

3303.3 

Intermediaries shall encourage/remind hospitals to 
send a copy of the Addendum to the Director of 
Medical Records. 

FI 

3303.4 

Intermediaries shall handle questions on the 
operation of GROUPER, MCE and OCE, in 
accordance with regular procedures. 

FI 


III. SUPPORTING INFORMA TIONAND POSSIBLE DESIGN CONSIDERATIONS 
A. Other Instructions: N/A 


X-Ref Requirement # 

Instructions 




B. Design Considerations: N/A 


X-Ref Requirement # 

Recommendation for Medicare System Requirements 




C. Interfaces: Grouper v22.0, Medicare Code Editor v21 .0, non-OPPS v20, and Outpatient 
Code Editor v5.3. 

D. Contractor Financial Reporting /Workload Impact: N/A 

E. Dependencies: Two attachments: the table and the Addendum. 

F. Testing Considerations: N/A 
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IV. SCHEDULE, CONTACTS, AND FUNDING 


Effective Date: October 1, 2004 


Implementation Date: October 4, 2004 
Pre-Implementation Contacts): Apri] Billingsley, 


abiliiogsiev@cms.Iihs.gov or 410-786-0140 
(carriers)',' arid Sarah "Shirey, sshirey@cms.hhs.gov 
or 4 10-786-01 87 (FIs) 

Post-Implementation Contact(s): Appropriate 
regional office 


These instructions shall be 
implemented within your 
current operating budget. 


10.2 - Relationship of ICD-9-CM Codes and Date of Service 
(Rev. 210, 06-18-04 ) 

PM B-02-027 (CR-2108), B-03-063, B-02-064, B-03-002 

Diagnosis codes must be reported based on the date of service (including, when applicable, the 
date of discharge) on the claim and not the date the claim is prepared or received. Medicare 
contractors are required to be able to edit claims on this basis, including providing for annual 
updates each October. The effective date for this requirement is: 

* Claims to DMERCs - April 1, 2003; 

* Claims to carriers - October 1 , 2002; and 

* Claims to intermediaries - October 1 , 1 983. 

Shared systems must establish date parameters for diagnosis editing. Use of actual effective and 
end dates is required when new diagnosis codes are issued or current codes become obsolete 
with the annual ICD-9-CM updates. During implementation, for codes already established on 
the shared system files, the effective date could be defaulted to January 1, 1990. Any codes on 
claims to carriers and DMERCs currently identified as no longer effective upon implementation 
could be considered to have an end date of December 31, 2001. Thereafter, any additions or 
terminations must have the actual effective and end date. 

The Health Insurance Portability and Accountability Act (HIPAA) requires that medical code 
sets must be date-of-service compliant Since 1CD-9-CM diagnosis codes are a medical code set, 
effective for dates of service on and after October 1 , 2004, CMS will no longer provide a 90-day 
grace period for providers to use in billing discontinued ICD-9-CM diagnosis codes on Medicare 
claims. The updated ICD-9-CM codes are published in the Federal Register in April/May of 
each year as part of the Proposed Changes to the Hospital Inpatient Prospective Payment 
Systems in table 6 and effective each October 1 . 

Carriers and DMERCs must eliminate the ICD-9-CM diagnosis grace period from their system 
effective with the October 1, 2004 update. Carriers and DMERCs will no longer accept 
discontinued diagnosis codes for dates of service October 1 through December 3 1 of the current 
year. Claims containing a discontinued ICD-9-CM diagnosis code will be returned as 
unprocessable. For dates of service beginning October 1, 2004, physicians, practitioners, and 
suppliers must use the current and valid diagnosis code that is then in effect. After the ICD-9- 
CM codes are published in the Federal Register, CMS places the new, revised and discontinued 
codes on the following Web site: http://www.cms.hhs.gov/medleam/icd9code.asp 

The CMS sends the updated 1CD-9-CM addendum to contractors on an annual basis via a 
recurring update notification instruction. The addendum is normally released to contractors 
each June. The addendum contains the new, revised, and discontinued diagnosis codes which are 
effective for dates of service on and after October 1 st . 


O 
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